www/apache
1
0
Fork 0
mirror of https://github.com/apache/httpd.git synced 2026-10-23 22:49:01 +03:00
Code Activity

mod_substitute: fix heap over-read in set_pattern() delimiter scanning

Browse Source 
* modules/filters/mod_substitute.c (set_pattern): Guard the
  pre-incrementing delimiter scan loops with a NUL check, preventing
  a read past the end of the allocation when the from or to field has
  no closing delimiter.

Assisted-by: Claude Sonnet 4.6 <noreply@anthropic.com>
GitHub: closes #685


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1936264 13f79535-47bb-0310-9956-ffa450edef68
This commit is contained in:
Joe Orton
2026-07-17 12:13:04 +00:00
parent 3f8cf7cdcf
commit cf75baf6a6
2 changed files with 4 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
changes-entries/substitute-pattern-oob-read.txt Normal file
View File

@@ -0,0 +1,2 @@
*) mod_substitute: Fix crash or misbehaviour when loading a Substitute
directive with a missing closing delimiter. [Joe Orton]

4
modules/filters/mod_substitute.c
View File

@@ -679,7 +679,7 @@ static const char *set_pattern(cmd_parms *cmd, void *cfg, const char *line)
if (delim)
from = ++ourline;
if (from) {
if (*ourline != delim) {
if (*ourline && *ourline != delim) {
while (*++ourline && *ourline != delim);
}
if (*ourline) {
@@ -688,7 +688,7 @@ static const char *set_pattern(cmd_parms *cmd, void *cfg, const char *line)
}
}
if (to) {
if (*ourline != delim) {
if (*ourline && *ourline != delim) {
while (*++ourline && *ourline != delim);
}
if (*ourline) {