- mod_ssl in Apache 2.0 up to 2.0.55, when configured with an SSL vhost with

[packages/apache.git] / apache-CVE-2005-3357.patch

http://bugs.gentoo.org/show_bug.cgi?id=115324

--- modules/ssl/ssl_engine_kernel.c	(Revision 368148)
+++ modules/ssl/ssl_engine_kernel.c	(Arbeitskopie)
@@ -202,11 +202,14 @@
     }
 
     /*
-     * Check to see if SSL protocol is on
+     * Check to see whether SSL is in use; if it's not, then no
+     * further access control checks are relevant.  (the test for
+     * sc->enabled is probably strictly unnecessary)
      */
-    if (!(sc->enabled || ssl)) {
+    if (!sc->enabled || !ssl) {
         return DECLINED;
     }
+
     /*
      * Support for per-directory reconfigured SSL connection parameters.
      *