arrfab / rpms / httpd

Forked from rpms/httpd 5 years ago
Clone

Blame SOURCES/httpd-2.4.6-CVE-2017-9798.patch

3540ca
diff --git a/server/core.c b/server/core.c
3540ca
index f60e8fa..245fcb6 100644
3540ca
--- a/server/core.c
3540ca
+++ b/server/core.c
3540ca
@@ -2061,6 +2061,12 @@ AP_CORE_DECLARE_NONSTD(const char *) ap_limit_section(cmd_parms *cmd,
3540ca
             /* method has not been registered yet, but resorce restriction
3540ca
              * is always checked before method handling, so register it.
3540ca
              */
3540ca
+            if (cmd->pool == cmd->temp_pool) {
3540ca
+                /* In .htaccess, we can't globally register new methods. */
3540ca
+                return apr_psprintf(cmd->pool, "Could not register method '%s' "
3540ca
+                                    "for %s from .htaccess configuration",
3540ca
+                                     method, cmd->cmd->name);
3540ca
+            }
3540ca
             methnum = ap_method_register(cmd->pool,
3540ca
                                          apr_pstrdup(cmd->pool, method));
3540ca
         }