Fossil SCM
Block an infinite loop in Th_ReportTaint() that can occur when the vuln-report setting is "fatal" and the error happens again while generating the fatal error page.
Commit
76f1ddb6c2cf03af0791eb42fde43338e07e696bdeda02207022e66afc497c0f
Parent
9d7b31552af7f87…
1 file changed
+4
-3
+4
-3
| --- src/th_main.c | ||
| +++ src/th_main.c | ||
| @@ -3084,14 +3084,14 @@ | ||
| 3084 | 3084 | Th_Interp *interp, /* Report error here, if an error is reported */ |
| 3085 | 3085 | const char *zWhere, /* Where the tainted string appears */ |
| 3086 | 3086 | const char *zStr, /* The tainted string */ |
| 3087 | 3087 | int nStr /* Length of the tainted string */ |
| 3088 | 3088 | ){ |
| 3089 | - char *zDisp; /* Dispensation */ | |
| 3090 | - const char *zVulnType; /* Type of vulnerability */ | |
| 3089 | + static const char *zDisp = 0; /* Dispensation; what to do with the error */ | |
| 3090 | + const char *zVulnType; /* Type of vulnerability */ | |
| 3091 | 3091 | |
| 3092 | - zDisp = db_get("vuln-report","log"); | |
| 3092 | + if( zDisp==0 ) zDisp = db_get("vuln-report","log"); | |
| 3093 | 3093 | if( is_false(zDisp) ) return 0; |
| 3094 | 3094 | if( strstr(zWhere,"SQL")!=0 ){ |
| 3095 | 3095 | zVulnType = "SQL-injection"; |
| 3096 | 3096 | }else{ |
| 3097 | 3097 | zVulnType = "XSS"; |
| @@ -3106,10 +3106,11 @@ | ||
| 3106 | 3106 | char *z = mprintf("tainted %s: \"", zWhere); |
| 3107 | 3107 | Th_ErrorMessage(interp, z, zStr, nStr); |
| 3108 | 3108 | fossil_free(z); |
| 3109 | 3109 | }else{ |
| 3110 | 3110 | char *z = mprintf("%#h", nStr, zStr); |
| 3111 | + zDisp = "off"; | |
| 3111 | 3112 | cgi_reset_content(); |
| 3112 | 3113 | style_submenu_enable(0); |
| 3113 | 3114 | style_set_current_feature("error"); |
| 3114 | 3115 | style_header("Configuration Error"); |
| 3115 | 3116 | @ <p>Error in a TH1 configuration script: |
| 3116 | 3117 |
| --- src/th_main.c | |
| +++ src/th_main.c | |
| @@ -3084,14 +3084,14 @@ | |
| 3084 | Th_Interp *interp, /* Report error here, if an error is reported */ |
| 3085 | const char *zWhere, /* Where the tainted string appears */ |
| 3086 | const char *zStr, /* The tainted string */ |
| 3087 | int nStr /* Length of the tainted string */ |
| 3088 | ){ |
| 3089 | char *zDisp; /* Dispensation */ |
| 3090 | const char *zVulnType; /* Type of vulnerability */ |
| 3091 | |
| 3092 | zDisp = db_get("vuln-report","log"); |
| 3093 | if( is_false(zDisp) ) return 0; |
| 3094 | if( strstr(zWhere,"SQL")!=0 ){ |
| 3095 | zVulnType = "SQL-injection"; |
| 3096 | }else{ |
| 3097 | zVulnType = "XSS"; |
| @@ -3106,10 +3106,11 @@ | |
| 3106 | char *z = mprintf("tainted %s: \"", zWhere); |
| 3107 | Th_ErrorMessage(interp, z, zStr, nStr); |
| 3108 | fossil_free(z); |
| 3109 | }else{ |
| 3110 | char *z = mprintf("%#h", nStr, zStr); |
| 3111 | cgi_reset_content(); |
| 3112 | style_submenu_enable(0); |
| 3113 | style_set_current_feature("error"); |
| 3114 | style_header("Configuration Error"); |
| 3115 | @ <p>Error in a TH1 configuration script: |
| 3116 |
| --- src/th_main.c | |
| +++ src/th_main.c | |
| @@ -3084,14 +3084,14 @@ | |
| 3084 | Th_Interp *interp, /* Report error here, if an error is reported */ |
| 3085 | const char *zWhere, /* Where the tainted string appears */ |
| 3086 | const char *zStr, /* The tainted string */ |
| 3087 | int nStr /* Length of the tainted string */ |
| 3088 | ){ |
| 3089 | static const char *zDisp = 0; /* Dispensation; what to do with the error */ |
| 3090 | const char *zVulnType; /* Type of vulnerability */ |
| 3091 | |
| 3092 | if( zDisp==0 ) zDisp = db_get("vuln-report","log"); |
| 3093 | if( is_false(zDisp) ) return 0; |
| 3094 | if( strstr(zWhere,"SQL")!=0 ){ |
| 3095 | zVulnType = "SQL-injection"; |
| 3096 | }else{ |
| 3097 | zVulnType = "XSS"; |
| @@ -3106,10 +3106,11 @@ | |
| 3106 | char *z = mprintf("tainted %s: \"", zWhere); |
| 3107 | Th_ErrorMessage(interp, z, zStr, nStr); |
| 3108 | fossil_free(z); |
| 3109 | }else{ |
| 3110 | char *z = mprintf("%#h", nStr, zStr); |
| 3111 | zDisp = "off"; |
| 3112 | cgi_reset_content(); |
| 3113 | style_submenu_enable(0); |
| 3114 | style_set_current_feature("error"); |
| 3115 | style_header("Configuration Error"); |
| 3116 | @ <p>Error in a TH1 configuration script: |
| 3117 |