Description: Avoid including dpkg droppings in globbed includes.
 Include /dir/* will ignore /dir/*.dpkg* files
Forwarded: not-needed
Author: Adam Conrad <adconrad@0c3.net>
Last-Update: 2012-02-25
Index: apache2/server/config.c
===================================================================
--- apache2.orig/server/config.c
+++ apache2/server/config.c
@@ -34,6 +34,7 @@
 #include "apr_portable.h"
 #include "apr_file_io.h"
 #include "apr_fnmatch.h"
+#include "apr_lib.h"
 
 #define APR_WANT_STDIO
 #define APR_WANT_STRFUNC
@@ -1787,6 +1788,29 @@
     return NULL;
 }
 
+static int fname_valid(const char *fname) {
+    const unsigned char *c = fname;
+    unsigned char bad_dpkg[] = "*.dpkg*";
+
+    if (!apr_isalnum(*c)) {
+        return 0;
+    }
+    ++c;
+
+    while (*c) {
+        if (!apr_isalnum(*c) && *c!='_' && *c!='-' && *c!='.') {
+            return 0;
+        }
+        ++c;
+    }
+
+    if (!apr_fnmatch(bad_dpkg, fname, 0)) {
+        return 0;
+    }
+
+    return 1;
+}
+
 static const char *process_resource_config_nofnmatch(server_rec *s,
                                                      const char *fname,
                                                      ap_directive_t **conftree,
@@ -1829,7 +1853,8 @@
         while (apr_dir_read(&dirent, APR_FINFO_DIRENT, dirp) == APR_SUCCESS) {
             /* strip out '.' and '..' */
             if (strcmp(dirent.name, ".")
-                && strcmp(dirent.name, "..")) {
+                && strcmp(dirent.name, "..")
+                && fname_valid(dirent.name)) {
                 fnew = (fnames *) apr_array_push(candidates);
                 fnew->fname = ap_make_full_path(ptemp, path, dirent.name);
             }
@@ -1918,7 +1943,8 @@
         if (strcmp(dirent.name, ".")
             && strcmp(dirent.name, "..")
             && (apr_fnmatch(fname, dirent.name,
-                            APR_FNM_PERIOD) == APR_SUCCESS)) {
+                            APR_FNM_PERIOD) == APR_SUCCESS)
+            && fname_valid(dirent.name)) {
             const char *full_path = ap_make_full_path(ptemp, path, dirent.name);
             /* If matching internal to path, and we happen to match something
              * other than a directory, skip it
