security-audits/apache-httpd/096-empty-response-header-underflows-pointer.patch at main · Swival/security-audits · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
diff --git a/modules/proxy/mod_proxy_uwsgi.c b/modules/proxy/mod_proxy_uwsgi.c
index 4e57196..1da2a73 100644
--- a/modules/proxy/mod_proxy_uwsgi.c
+++ b/modules/proxy/mod_proxy_uwsgi.c
@@ -386,9 +386,11 @@ static int uwsgi_response(request_rec *r, proxy_conn_rec * backend,
         }
         while (apr_isspace(*value))
             ++value;
-        for (end = &value[strlen(value) - 1];
-             end > value && apr_isspace(*end); --end)
-            *end = '\0';
+        if (*value) {
+            for (end = &value[strlen(value) - 1];
+                 end > value && apr_isspace(*end); --end)
+                *end = '\0';
+        }
         if (*ap_scan_http_field_content(value)) {
             /* invalid value */
             len = -1;