Blame SOURCES/httpd-2.4.6-CVE-2014-0098.patch

af9b8b
--- a/modules/loggers/mod_log_config.c	2013/11/15 17:07:52	1542329
af9b8b
+++ b/modules/loggers/mod_log_config.c	2014/03/10 11:23:47	1575904
af9b8b
@@ -543,14 +543,24 @@
af9b8b
 
af9b8b
         while ((cookie = apr_strtok(cookies, ";", &last1))) {
af9b8b
             char *name = apr_strtok(cookie, "=", &last2);
af9b8b
-            if (name) {
af9b8b
-                char *value = name + strlen(name) + 1;
af9b8b
-                apr_collapse_spaces(name, name);
af9b8b
+            /* last2 points to the next char following an '=' delim,
af9b8b
+               or the trailing NUL char of the string */
af9b8b
+            char *value = last2;
af9b8b
+            if (name && *name &&  value && *value) {
af9b8b
+                char *last = value - 2;
af9b8b
+                /* Move past leading WS */
af9b8b
+                name += strspn(name, " \t");
af9b8b
+                while (last >= name && apr_isspace(*last)) {
af9b8b
+                    *last = '\0';
af9b8b
+                    --last;
af9b8b
+                }
af9b8b
 
af9b8b
                 if (!strcasecmp(name, a)) {
af9b8b
-                    char *last;
af9b8b
-                    value += strspn(value, " \t");  /* Move past leading WS */
af9b8b
-                    last = value + strlen(value) - 1;
af9b8b
+                    /* last1 points to the next char following the ';' delim,
af9b8b
+                       or the trailing NUL char of the string */
af9b8b
+                    last = last1 - (*last1 ? 2 : 1);
af9b8b
+                    /* Move past leading WS */
af9b8b
+                    value += strspn(value, " \t");
af9b8b
                     while (last >= value && apr_isspace(*last)) {
af9b8b
                        *last = '\0';
af9b8b
                        --last;
af9b8b
@@ -559,6 +569,7 @@
af9b8b
                     return ap_escape_logitem(r->pool, value);
af9b8b
                 }
af9b8b
             }
af9b8b
+            /* Iterate the remaining tokens using apr_strtok(NULL, ...) */
af9b8b
             cookies = NULL;
af9b8b
         }
af9b8b
     }