avoid crash on relative logout URL parameter; release 2.3.4

Signed-off-by: Hans Zandbelt <[email protected]>

ChangeLog

@@ -1,3 +1,7 @@
+04/27/2018
+- avoid crash when a relative logout URL parameter is passed in; thanks Vivien Delenne 
+- release 2.3.4
+
 03/22/2018
 - interpret X-Forwarded-Host when doing XSRF protection on the after-logout URL; see #341; thanks @pepe79
 - bump to 2.3.4rc4

configure.ac

@@ -1,4 +1,4 @@
-AC_INIT([mod_auth_openidc],[2.3.4rc4],[[email protected]])
+AC_INIT([mod_auth_openidc],[2.3.4],[[email protected]])
 
 AC_SUBST(NAMEVER, AC_PACKAGE_TARNAME()-AC_PACKAGE_VERSION())
 

src/mod_auth_openidc.c

@@ -2584,12 +2584,14 @@ static int oidc_handle_logout(request_rec *r, oidc_cfg *c,
 
 		}
 
-		if ((strstr(oidc_get_current_url_host(r), uri.hostname) == NULL)
-				|| (strstr(uri.hostname, oidc_get_current_url_host(r)) == NULL)) {
+		const char *c_host = oidc_get_current_url_host(r);
+		if ((uri.hostname != NULL)
+				&& ((strstr(c_host, uri.hostname) == NULL)
+						|| (strstr(uri.hostname, c_host) == NULL))) {
 			error_description =
 					apr_psprintf(r->pool,
 							"logout value \"%s\" does not match the hostname of the current request \"%s\"",
-							apr_uri_unparse(r->pool, &uri, 0), oidc_get_current_url_host(r));
+							apr_uri_unparse(r->pool, &uri, 0), c_host);
 			oidc_error(r, "%s", error_description);
 			return oidc_util_html_send_error(r, c->error_template,
 					"Invalid Request", error_description,
@@ -2618,8 +2620,7 @@ static int oidc_handle_logout(request_rec *r, oidc_cfg *c,
 		char *logout_request = apr_pstrdup(r->pool, end_session_endpoint);
 		if (id_token_hint != NULL) {
 			logout_request = apr_psprintf(r->pool, "%s%sid_token_hint=%s",
-					logout_request,
-					strchr(logout_request ? logout_request : "",
+					logout_request, strchr(logout_request ? logout_request : "",
 							OIDC_CHAR_QUERY) != NULL ?
 									OIDC_STR_AMP :
 									OIDC_STR_QUERY,