From be1df4d381c6640d5679cb48952b186fbe9cb705 Mon Sep 17 00:00:00 2001 From: reyk Date: Fri, 25 Jul 2014 20:13:06 +0000 Subject: [PATCH] Don't leak docroot in the error message if the default index file is missing. OK florian@ --- usr.sbin/httpd/server_file.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/usr.sbin/httpd/server_file.c b/usr.sbin/httpd/server_file.c index c4814a04ccd..5a360296558 100644 --- a/usr.sbin/httpd/server_file.c +++ b/usr.sbin/httpd/server_file.c @@ -1,4 +1,4 @@ -/* $OpenBSD: server_file.c,v 1.13 2014/07/25 13:10:18 reyk Exp $ */ +/* $OpenBSD: server_file.c,v 1.14 2014/07/25 20:13:06 reyk Exp $ */ /* * Copyright (c) 2006 - 2014 Reyk Floeter @@ -89,7 +89,8 @@ server_file_access(struct http_descriptor *desc, char *path, size_t len, } /* Check again but set len to 0 to avoid recursion */ - return (server_file_access(desc, path, 0, st)); + if (server_file_access(desc, path, 0, st) != 0) + goto fail; } else if (!S_ISREG(st->st_mode)) { /* Don't follow symlinks and ignore special files */ errno = EACCES; -- 2.20.1