Segfault in oidc_util_strcasestr @ 19232c2 when OIDCXForwardedHeaders:forwarded is configured, but in the headers

[daviddpd]

SO, it seems that when

OIDCXForwardedHeaders X-Forwarded-Host X-Forwarded-Port X-Forwarded-Proto Forwarded

is defined with Forwarded ... but the forwarded header is not present ... aka the request logged by mod_forensic is

+ZbqJJIhIQtvPo9Dt6zBwzQAAABA|GET / HTTP/1.1|host:earthworm.care2.com|user-agent:curl/7.61.1|accept:*/*|x-forwarded-for:10.32.1.2

A segfault is generated in oidc_util_strcasestr as it looks like s1 is passed as null. I tried to create a patch, but as I don't know the code very well, it didn't help.

As it turns out I don't believe I need Forwarded ... so I can just drop that from OIDCXForwardedHeaders , but I think it's worth adding a check in oidc_util_strcasestr ... or down lower on the function tree, for null pointers.

#0  oidc_util_strcasestr (s1=0x0, s2=s2@entry=0x560493e30248 "proto=") at src/util.c:619
        s = 0x0
        p = 0x560493e30248 "proto="
#1  0x00007f17ffdd3611 in oidc_util_hdr_forwarded_get (r=0x560493e3c220, elem=elem@entry=0x7f17ffdf47fa "proto") at src/util.c:638
        value = <optimized out>
        ptr = 0x0
        item = 0x560493e30248 "proto="
#2  0x00007f17ffdd376c in oidc_get_current_url_scheme (r=r@entry=0x560493e3c220, x_forwarded_headers=x_forwarded_headers@entry=15 '\017') at src/util.c:659
        scheme_str = 0x0
        __FUNCTION__ = "oidc_get_current_url_scheme"
#3  0x00007f17ffdd3f44 in oidc_get_current_url_base (r=r@entry=0x560493e3c220, x_forwarded_headers=x_forwarded_headers@entry=15 '\017') at src/util.c:825
        scheme_str = 0x0
        host_str = 0x0
        port_str = 0x0
        url = <optimized out>
#4  0x00007f17ffdd4164 in oidc_get_current_url (r=r@entry=0x560493e3c220, x_forwarded_headers=<optimized out>) at src/util.c:858
        url = 0x0
        path = 0x560493e3dad8 "/"
        uri = {scheme = 0x560493e3c220 "\250\301\343\223\004V", hostinfo = 0x7f1815860718 <apr_strtok+120> "H\205\300t\343\306\003", user = 0x4 <error: Cannot access memory at address 0x4>,
          password = 0x560493e3c220 "\250\301\343\223\004V", hostname = 0x7f17ffde55c5 "*/*", port_str = 0x1 <error: Cannot access memory at address 0x1>, path = 0x7ffc15d4c480 "\vA\343\223\004V",
          query = 0x7f17ffdd34f7 <oidc_util_hdr_in_accept_contains+151> "\205\300u\rB\017\266\004#<;t<\204\300t8L\211\352L\211\366\061\377\350\333\332\374\377H\211\303H\205\300u\267\061\300H\213L$\bdH3\f%(", fragment = 0x560493e3410b "", hostent = 0x5a538d4b5e84a900, port = 49696, is_initialized = 1, dns_looked_up = 1, dns_resolved = 0}
        __FUNCTION__ = "oidc_get_current_url"
#5  0x00007f17ffda64a5 in oidc_handle_unauthenticated_user (c=0x5604935efdd8, r=0x560493e3c220) at src/mod_auth_openidc.c:899
No locals.
#6  oidc_handle_unauthenticated_user (r=0x560493e3c220, c=0x5604935efdd8) at src/mod_auth_openidc.c:863
No locals.
#7  0x00007f17ffdaf196 in oidc_check_userid_openidc (r=r@entry=0x560493e3c220, c=c@entry=0x5604935efdd8) at src/mod_auth_openidc.c:4230
        _oidc_metrics_tstart = 0
        __FUNCTION__ = "oidc_check_userid_openidc"
        rc = 0
        needs_save = 0 '\000'
        session = 0x560493e33d40
        retain = 0x0

[zandbelt]

this is fixed in c2f200f, thanks for reporting!