From: Moritz Schlarb Date: Mon, 22 Jul 2024 14:16:02 +0200 Subject: avoid crash when the Forwarded header is not present but OIDCXForwardedHeaders is configured for it; see #1171; thanks @daviddpd Signed-off-by: Hans Zandbelt --- src/util.c | 4 +++- test/test.c | 4 ++++ 2 files changed, 7 insertions(+), 1 deletion(-) diff --git a/src/util.c b/src/util.c index 7a86c24..8bcfb94 100644 --- a/src/util.c +++ b/src/util.c @@ -437,6 +437,8 @@ char* oidc_util_javascript_escape(apr_pool_t *pool, const char *s) { char* oidc_util_strcasestr(const char *s1, const char *s2) { const char *s = s1; const char *p = s2; + if ((s == NULL) || (p == NULL)) + return NULL; do { if (!*p) return (char*) s1; @@ -468,7 +470,7 @@ static const char* oidc_util_hdr_forwarded_get(const request_rec *r, const char if (ptr) *ptr = '\0'; } - return apr_pstrdup(r->pool, value); + return value ? apr_pstrdup(r->pool, value) : NULL; } /* diff --git a/test/test.c b/test/test.c index 714f523..c75a940 100755 --- a/test/test.c +++ b/test/test.c @@ -1343,6 +1343,10 @@ static char * test_current_url(request_rec *r) { apr_table_unset(r->headers_in, "Forwarded"); + // it should not crash when Forwarded is not present + url = oidc_get_current_url(r, OIDC_HDR_FORWARDED); + TST_ASSERT_STR("test_current_url (16)", url, "https://www.example.com/private/?foo=bar¶m1=value1"); + apr_table_set(r->headers_in, "Host", "www.example.com"); return 0;