Repository navigation
mod_dav: Fix NULL pointer dereference in ms_wdv.c check_locked_by_other() - #883
Closed
arturobernalg wants to merge 2 commits into
Closed
arturobernalg wants to merge 2 commits into
arturobernalg wants to merge 2 commits into
Conversation
…er(). Both goto out paths before open_lockdb() runs leave lockdb at its NULL initializer, and the out label dereferenced it unconditionally. A DAV request whose dav_get_resource() or open_lockdb() call fails (e.g. a PUT/DELETE/MOVE/LOCK to a URL with extraneous path components under DAVMSext WDV) crashes the worker. Guard the call like the existing pattern in mswdv_combined_lock() a few hundred lines below. PR: 70051
Enables DAVMSext on the pytest_suite mod_dav test directory and adds test_dav_mswdv_null_deref: PUT a resource, then PUT past it with an extra path component so dav_get_resource() fails before any lockdb is opened, and confirm the server returns a clean DAV error instead of crashing, and is still alive afterwards. Verified this reproduces the bug: against the pre-fix check_locked_by_other() the test fails with a connection reset (the worker segfaults); against 28c8dbd it passes. PR: 70051
arturobernalg
force-pushed
the
fix/httpd-70051-dav-mswdv-null-deref
branch
from
October 25, 2026 04:53
791d449 to
b3b929a
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Both
goto outpaths incheck_locked_by_other()(modules/dav/main/ms_wdv.c) that fire beforeopen_lockdb()runs leavelockdbat itsNULLinitializer, and theoutlabel dereferenced it unconditionally:A DAV request whose
dav_get_resource()oropen_lockdb()call fails crashes the worker with a NULL pointer dereference. The most reliable trigger is a request to a URL whose last filesystem-resolvable component is a file plus extra path components, underDAVMSext WDV.The sister function
mswdv_combined_lock()a few hundred lines below already guards the same call (if (lockdb) (*lockdb->hooks->close_lockdb)(lockdb);), so this fix mirrors that existing pattern.Also adds a regression test (
test_dav_mswdv_null_derefintest/pytest_suite/tests/t/modules/test_dav.py, plusDAVMSext Allon the test directory): PUT a resource, then PUT past it with an extra path component, and confirm the server returns a clean DAV error and is still alive afterwards. Verified it fails with a connection reset against the pre-fix code and passes against this fix.PR: https://bz.apache.org/bugzilla/show_bug.cgi?id=70051
(see
SECURITY.mdandhttps://www.apache.org/security/#reporting-a-vulnerability).
APLOGNO()tag;numbers are assigned by a committer at merge time (see
docs/log-message-tags/README).(N/A, no log messages added.)
changes-entries/*.txtfile is included,following the template in
README.CHANGES(not needed otherwise).(Not needed - one-line NULL-guard fix, no behavior change on the success path.)
(Added: test_dav_mswdv_null_deref in test/pytest_suite/tests/t/modules/test_dav.py.)