From cf75baf6a656bf810eb9375b6338557df58bbb2b Mon Sep 17 00:00:00 2001 From: Joe Orton Date: Fri, 17 Jul 2026 12:13:04 +0000 Subject: [PATCH] mod_substitute: fix heap over-read in set_pattern() delimiter scanning * modules/filters/mod_substitute.c (set_pattern): Guard the pre-incrementing delimiter scan loops with a NUL check, preventing a read past the end of the allocation when the from or to field has no closing delimiter. Assisted-by: Claude Sonnet 4.6 GitHub: closes #685 git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1936264 13f79535-47bb-0310-9956-ffa450edef68 --- changes-entries/substitute-pattern-oob-read.txt | 2 ++ modules/filters/mod_substitute.c | 4 ++-- 2 files changed, 4 insertions(+), 2 deletions(-) create mode 100644 changes-entries/substitute-pattern-oob-read.txt diff --git a/changes-entries/substitute-pattern-oob-read.txt b/changes-entries/substitute-pattern-oob-read.txt new file mode 100644 index 0000000000..55eea6f041 --- /dev/null +++ b/changes-entries/substitute-pattern-oob-read.txt @@ -0,0 +1,2 @@ + *) mod_substitute: Fix crash or misbehaviour when loading a Substitute + directive with a missing closing delimiter. [Joe Orton] diff --git a/modules/filters/mod_substitute.c b/modules/filters/mod_substitute.c index ada62a6da1..2533d7dcd0 100644 --- a/modules/filters/mod_substitute.c +++ b/modules/filters/mod_substitute.c @@ -679,7 +679,7 @@ static const char *set_pattern(cmd_parms *cmd, void *cfg, const char *line) if (delim) from = ++ourline; if (from) { - if (*ourline != delim) { + if (*ourline && *ourline != delim) { while (*++ourline && *ourline != delim); } if (*ourline) { @@ -688,7 +688,7 @@ static const char *set_pattern(cmd_parms *cmd, void *cfg, const char *line) } } if (to) { - if (*ourline != delim) { + if (*ourline && *ourline != delim) { while (*++ourline && *ourline != delim); } if (*ourline) {