bin/50374: httpd passes duplicated path to cgi-bin

[okuyama%flex.phys.tohoku.ac.jp@localhost]

>Number:         50374
>Category:       bin
>Synopsis:       httpd passes duplicated path to cgi-bin
>Confidential:   no
>Severity:       serious
>Priority:       high
>Responsible:    bin-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Wed Oct 28 15:20:00 +0000 2015
>Originator:     Rin Okuyama
>Release:        7.99.21
>Organization:
Department of Physics, Tohoku University
>Environment:
NetBSD kobrmc7 7.99.21 NetBSD 7.99.21 (XXX) #0: Tue Oct  6 01:38:01 JST 2015  root@XXX:XXX amd64
>Description:
httpd passes duplicated path to cgi-bin. For example, the followings are
outputs of pkgsrc/www/viewvc:

* with httpd (20151028)
<a href="/cgi-bin/viewvc.cgi/cvsroot//cvsroot/?sortdir=down#dirlist">File</a>

* with bozohttpd (20150320)
<a href="/cgi-bin/viewvc.cgi/cvsroot/?sortdir=down#dirlist">File</a>

"/cvsroot" is duplicated in the former. This bug was introduced to
src/libexec/httpd/cgi-bozo.c in Rev. 1.26:

  http://cvsweb.netbsd.org/bsdweb.cgi/src/libexec/httpd/cgi-bozo.c.diff?r1=1.25&r2=1.26&f=H

See codes from Revs. 1.25 and 1.26 below.

* Rev. 1.25

   317                  command = file + CGIBIN_PREFIX_LEN + 1;
   318                  if ((s = strchr(command, '/')) != NULL) {
   319                          info = bozostrdup(httpd, s);
   320                          *s = '\0';
   321                  }

* Rev. 1.26

   317                  snprintf(command, sizeof(command), "%s",
   318                      file + CGIBIN_PREFIX_LEN + 1);
   319                  if ((s = strchr(command, '/')) != NULL) {
   320                          info = bozostrdup(httpd, s);
   321                          *s = '\0';
   322                  }

In Rev. 1.25, a string pointed by "file" is trimmed, whereas it is not
in Rev. 1.26. This is the cause of the duplication.
>How-To-Repeat:
Run some cgi-bin, e.g., pkgsrc/www/viewvc, with httpd compiled from
source after Apr 19 2015.
>Fix:
--- src/libexec/httpd/cgi-bozo.c.orig	2015-10-28 23:01:12.000000000 +0900
+++ src/libexec/httpd/cgi-bozo.c	2015-10-28 23:01:21.000000000 +0900
@@ -319,12 +319,12 @@
 		argv[ix++] = path;
 			/* argv[] = [ path, command, query, NULL ] */
 	} else {
-		snprintf(command, sizeof(command), "%s",
-		    file + CGIBIN_PREFIX_LEN + 1);
-		if ((s = strchr(command, '/')) != NULL) {
+		s = strchr(t = file + CGIBIN_PREFIX_LEN + 1, '/');
+		if (s != NULL) {
 			info = bozostrdup(httpd, s);
 			*s = '\0';
 		}
+		snprintf(command, sizeof(command), "%s", t);
 		path = bozomalloc(httpd,
 				strlen(httpd->cgibin) + 1 + strlen(command) + 1);
 		strcpy(path, httpd->cgibin);