Joe Orton e3a8b4e1e6 mod_cgid: Raise the limit on the number of environment variables passed ...

to a script from 256 to APACHE_ARG_MAX, and bound URI/query/env-value
lengths against the configured request limits rather than APR_PATH_MAX.
PR 70270.

* changes-entries/cgid-env-limit.txt: Add changelog entry.

* modules/generators/mod_cgid.c: Replace ENV_COUNT_MAX with ENV_VAL_MAX,
  a sanity bound on the length of a single environment variable value.
  (get_req): Take the main server_rec as an argument.  Allow up to
  APACHE_ARG_MAX environment variables; check uri_len and args_len
  against the configured LimitRequestLine rather than APR_PATH_MAX;
  check each environment variable value against ENV_VAL_MAX.
  (send_req): Fail with APR_ENOSPC if more than APACHE_ARG_MAX
  environment variables are present.
  (cgid_server): Pass main_server to get_req.

* test/modules/generators/htdocs/cgi/: New tests scripts.

* test/modules/generators/test_001_cgid.py: New tests.

Submitted by: Emmanuel Dreyfus <manu netbsd.org>, jorton
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
GitHub: closes #850


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1939165 13f79535-47bb-0310-9956-ffa450edef68

2026-10-16 18:55:52 +00:00

..

ssi

…

arglen.py

mod_cgid: Raise the limit on the number of environment variables passed

2026-10-16 18:55:52 +00:00

argv.py

…

envcount.py

mod_cgid: Raise the limit on the number of environment variables passed

2026-10-16 18:55:52 +00:00

noread.py

…

nph-hello.py

…

redirect.py

…

sleep_trap.py

…

sleep.py

…

stderr_fail.py

…