Bug 36783

The following code, around line 375 of server/request.c, contains an error  
that may lead to failures in SymlinksIfOwnerMatch on some platforms: 
    
  /* OPT_SYM_OWNER only works if we can get the owner of     
   * both the file and symlink.  First fill in a missing     
   * owner of the symlink, then get the info of the target.     
   */     
  if (!(lfi->valid & APR_FINFO_OWNER)) {     
      if ((res = apr_stat(&fi, d,      
                          lfi->valid | APR_FINFO_LINK | APR_FINFO_OWNER, p))     
          != APR_SUCCESS) {     
          return HTTP_FORBIDDEN;     
      }     
  }     
     
  if ((res = apr_stat(&fi, d, lfi->valid & ~(APR_FINFO_NAME), p))     
      != APR_SUCCESS) {     
      return HTTP_FORBIDDEN;     
  }     
     
  if (apr_uid_compare(fi.user, lfi->user) != APR_SUCCESS) {     
      return HTTP_FORBIDDEN;     
  }     
    
The apr_stat calls are supposed to set lfi->user and fi.user so they can be   
compared. However, they're both operating on &fi, meaning that lfi->user   
doesn't get set. 
     
On platforms where FINFO_OWNER isn't already valid when we reach this code 
(including Win32, according to William A. Rowe, Jr.), lfi->user could be 
random junk when compared, likely leading to a incorrect HTTP_FORBIDDEN result 
(and perhaps the small possibility of an incorrect OK result).  
    
The first apr_stat() call should set lfi instead of &fi:  
    
  if (!(lfi->valid & APR_FINFO_OWNER)) {     
      if ((res = apr_stat(lfi, d,