[Xitami] BUG - uppercase subdirs of an Alias - potenial NULL pointer assignemnt

[Francis Turner]

Just found a lovely bug.

I have (for test purposes!) within my defaults.cfg an alias line
usrlocal = "/usr/local"

(Xitami is installed and runing in /usr/local/xitami-25b5)

I also have a subdirectory from /usr/local/xitami-25b5/webpages called 
UPPERCASE

http://computer/UPPERCASE/ works and returns the directory contents
http://computer/usrlocal/xitami-25b5/webpages/ works and gives the home page
http://computer/usrlocal/xitami-25b5/webpages/UPPERCASE/ gives a 404

The same applies to ftp aliases since they also call the same routine 
(see below)! but if ftproot is set to /usr/local/ for a user then that 
user can go to ftp://computer/xitami-25b5/webpages/UPPERCASE/ just fine

It looks like this is because the http_match_alias () routine in 
smthttpd.c lowercases the buffer for comparison and then returns as the 
 value of char **base the lowercased remainder of the url not the 
equivalent untoughed raminder of the url.

I think the fix would be to keep track of the offset and return that 
instead which means that base would have to be changed from a char** to 
an int *. Alternatively you could set base to &uri[slash-buffer] 
(??should be &uri[slash-buffer-1] if the leading / is absent??)

In looking at this code I think I also see a potential null pointer 
assignment (I think it never actually occurs because this routine is 
always called with a parameter for base) but there seems to be no check 
to see whetehr base == NULL before assigning *base to buffer at line 832 
although there is such a check for line 851

Francis

-- 
...if the US Government were ever to get really serious about Internet 
security, the top players in Microsoft's management hierarchy would find 
themselves handcuffed, blindfolded, led onto a tarmac within some obscure 
Air Force base, and shot.
-- Thomas C Greene (http://www.theregister.co.uk/content/55/23223.html)