Define ap_method_mask_t (typedef for apr_uint64_t) and use for method

bitmasks rather than apr_int64_t.  Fixes UBSan errors shifting to the
top bit of a signed integer.

* include/httpd.h: Add ap_method_mask_t, use it for AP_METHOD_BIT.
  (struct ap_method_mask_t): Likewise for method_mask field.
  (struct request_rec): Likewise for allowed field.

* include/http_config.h (struct cmd_parms): Likewise for limited field.

* include/ap_mmn.h: Bump MMN major.

* modules/*/*.c: Adjust all method masks to use ap_method_mask_t.


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1874114 13f79535-47bb-0310-9956-ffa450edef68

CHANGES

@@ -1,6 +1,11 @@
                                                          -*- coding: utf-8 -*-
 Changes with Apache 2.5.1
 
+  *) core: ap_method_mask_t type added for method bitmasks, changed
+     from apr_int64_t and used for the method_mask field in
+     ap_method_list_t, AP_METHOD_BIT, allowed field of request_rec,
+     limited field of cmd_parms.  [Joe Orton]
+
   *) mod_ssl: Do not keep connections to OCSP responders alive when doing
      OCSP requests.  PR 64135.  [Ruediger Pluem]
 

include/ap_mmn.h

@@ -621,14 +621,15 @@
  * 20190312.7 (2.5.1-dev)  AP_REG_DEFAULT macro in ap_regex.h
  * 20190312.8 (2.5.1-dev)  ap_is_chunked() in httpd.h
  * 20190312.9 (2.5.1-dev)  AP_REG_NO_DEFAULT macro in ap_regex.h
+ * 20200217.0 (2.5.1-dev)  Add and use ap_method_mask_t type
  */
 
 #define MODULE_MAGIC_COOKIE 0x41503235UL /* "AP25" */
 
 #ifndef MODULE_MAGIC_NUMBER_MAJOR
-#define MODULE_MAGIC_NUMBER_MAJOR 20190312
+#define MODULE_MAGIC_NUMBER_MAJOR 20200217
 #endif
-#define MODULE_MAGIC_NUMBER_MINOR 9            /* 0...n */
+#define MODULE_MAGIC_NUMBER_MINOR 0            /* 0...n */
 
 /**
  * Determine if the server's current MODULE_MAGIC_NUMBER is at least a

include/http_config.h

@@ -295,7 +295,7 @@ struct cmd_parms_struct {
     /** Table of directives allowed per AllowOverrideList */
     apr_table_t *override_list;
     /** Which methods are <Limit>ed */
-    apr_int64_t limited;
+    ap_method_mask_t limited;
     /** methods which are limited */
     apr_array_header_t *limited_xmethods;
     /** methods which are xlimited */

include/httpd.h

@@ -637,10 +637,14 @@ AP_DECLARE(const char *) ap_get_server_built(void);
  */
 #define METHODS     64
 
+/**
+ * The type used for method masks.
+ */
+typedef apr_uint64_t ap_method_mask_t;
 /**
  * The method mask bit to shift for anding with a bitmask.
  */
-#define AP_METHOD_BIT ((apr_int64_t)1)
+#define AP_METHOD_BIT ((ap_method_mask_t)1)
 /** @} */
 
 
@@ -656,7 +660,7 @@ typedef struct ap_method_list_t ap_method_list_t;
  */
 struct ap_method_list_t {
     /** The bitmask used for known methods */
-    apr_int64_t method_mask;
+    ap_method_mask_t method_mask;
     /** the array used for extension methods */
     apr_array_header_t *method_list;
 };
@@ -886,7 +890,7 @@ struct request_rec {
      *  HTTP_METHOD_NOT_ALLOWED.  Unfortunately this means that a Script GET
      *  handler can't be installed by mod_actions.
      */
-    apr_int64_t allowed;
+    ap_method_mask_t allowed;
     /** Array of extension methods */
     apr_array_header_t *allowed_xmethods;
     /** List of allowed methods */

modules/aaa/mod_access_compat.c

@@ -53,7 +53,7 @@ enum allowdeny_type {
 };
 
 typedef struct {
-    apr_int64_t limited;
+    ap_method_mask_t limited;
     union {
         char *from;
         apr_ipsubnet_t *ip;
@@ -243,7 +243,7 @@ static int find_allowdeny(request_rec *r, apr_array_header_t *a, int method)
 {
 
     allowdeny *ap = (allowdeny *) a->elts;
-    apr_int64_t mmask = (AP_METHOD_BIT << method);
+    ap_method_mask_t mmask = (AP_METHOD_BIT << method);
     int i;
     int gothost = 0;
     const char *remotehost = NULL;

modules/aaa/mod_allowmethods.c

@@ -45,7 +45,7 @@
 
 typedef struct am_conf_t {
     int allowed_set;
-    apr_int64_t allowed;
+    ap_method_mask_t allowed;
 } am_conf_t;
 
 module AP_MODULE_DECLARE_DATA allowmethods_module;

modules/aaa/mod_authz_core.c

@@ -70,7 +70,7 @@ struct authz_section_conf {
     const char *provider_args;
     const void *provider_parsed_args;
     const authz_provider *provider;
-    apr_int64_t limited;
+    ap_method_mask_t limited;
     authz_logic_op op;
     int negate;
     /** true if this is not a real container but produced by AuthMerging;
@@ -478,7 +478,7 @@ static const char *add_authz_section(cmd_parms *cmd, void *mconfig,
     authz_section_conf *old_section = conf->section;
     authz_section_conf *section;
     int old_overrides = cmd->override;
-    apr_int64_t old_limited = cmd->limited;
+    ap_method_mask_t old_limited = cmd->limited;
     const char *errmsg;
 
     if (endp == NULL) {
@@ -1016,7 +1016,7 @@ static authz_status method_check_authorization(request_rec *r,
                                                const char *require_line,
                                                const void *parsed_require_line)
 {
-    const apr_int64_t *allowed = parsed_require_line;
+    const ap_method_mask_t *allowed = parsed_require_line;
     if (*allowed & (AP_METHOD_BIT << r->method_number))
         return AUTHZ_GRANTED;
     else
@@ -1027,7 +1027,7 @@ static const char *method_parse_config(cmd_parms *cmd, const char *require_line,
                                        const void **parsed_require_line)
 {
     const char *w, *t;
-    apr_int64_t *allowed = apr_pcalloc(cmd->pool, sizeof(apr_int64_t));
+    ap_method_mask_t *allowed = apr_pcalloc(cmd->pool, sizeof *allowed);
 
     t = require_line;
 

modules/http/http_protocol.c

@@ -854,7 +854,7 @@ AP_DECLARE(const char *) ap_get_status_line(int status)
  */
 static char *make_allow(request_rec *r)
 {
-    apr_int64_t mask;
+    ap_method_mask_t mask;
     apr_array_header_t *allow = apr_array_make(r->pool, 10, sizeof(char *));
     apr_hash_index_t *hi = apr_hash_first(r->pool, methods_registry);
     /* For TRACE below */

modules/http/http_request.c

@@ -857,7 +857,7 @@ AP_DECLARE(void) ap_allow_standard_methods(request_rec *r, int reset, ...)
 {
     int method;
     va_list methods;
-    apr_int64_t mask;
+    ap_method_mask_t mask;
 
     /*
      * Get rid of any current settings if requested; not just the