* subversion/mod_dav_svn/reports/list.c
(dav_svn__list_report): CVE-2018-11803 - Fix access to potentially uninitialized local
pointer variable.
@@ -201,7 +201,7 @@ dav_svn__list_report(const dav_resource *resource,
dav_svn__authz_read_baton arb;
const dav_svn_repos *repos = resource->info->repos;
int ns;
- const char *full_path;
+ const char *full_path = NULL;
svn_boolean_t path_info_only;
svn_fs_root_t *root;
svn_depth_t depth = svn_depth_unknown;
@@ -280,6 +280,12 @@ dav_svn__list_report(const dav_resource *resource,
/* else unknown element; skip it */
}
+ if (! full_path)
+ {
+ return dav_svn__new_error_svn(resource->pool, HTTP_BAD_REQUEST, 0, 0,
+ "Request was missing the path argument");
+ }
+
/* Build authz read baton */
arb.r = resource->info->r;
arb.repos = resource->info->repos;
