Arturo Bernal c1b7c82f7e core: Reject invalid values of LimitXMLRequestBody. ...

set_limit_xml_req_body() used atol(), so "abc123" and "123abc" were
accepted as 0 and 123, and a value out of range of a long gave an
undefined result. Parse the whole argument with apr_strtoff() like
LimitRequestBody, and reject values that do not fit in limit_xml_body
or exceed AP_MAX_LIMIT_XML_BODY.

PR: 69975
GitHub: closes #825


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1939121 13f79535-47bb-0310-9956-ffa450edef68

2026-10-14 17:07:23 +00:00

..

mpm

mpm_motorz: track current request for suspend/resume; guard poller re-join

2026-09-11 22:31:03 +00:00

.indent.pro

…

buildmark.c

Make sources build with latest clang version

2023-04-27 07:14:36 +00:00

config.c

Cast cmd_parms.info to correct type (apr_size_t).

2026-06-29 10:10:40 +00:00

config.m4

…

connection.c

*) core: adding a new hook and method to the API:

2022-03-18 09:52:52 +00:00

core_filters.c

When we are at flush_max_threshold and the next bucket is a metadata (i.e. next->length == 0), we still need to re-check for flush_max_threshold and associated optimisation (is_in_memory_bucket()) when we process this metadata bucket in the next iteration of the loop.

2023-05-21 17:46:22 +00:00

core.c

core: Reject invalid values of LimitXMLRequestBody.

2026-10-14 17:07:23 +00:00

core.h

util_filter: export ap_filter_adopt_brigade() since mod_ssl uses it.

2020-05-10 12:34:53 +00:00

eoc_bucket.c

…

eor_bucket.c

core: add r->flushed flag and set it when the response is sent.

2020-04-01 22:56:44 +00:00

error_bucket.c

core, modules: like r1657897 but for core and other modules than mod_proxy.

2015-03-10 17:25:17 +00:00

gen_test_char.c

core: Add ap_unescape_url_ex() for better decoding control, and deprecate

2021-10-07 12:00:20 +00:00

gen_test_char.dsp

…

headers_bucket.c

*) core/mod_http/mod_http2:

2022-04-04 08:24:09 +00:00

listen.c

* Use correct configuration variable

2025-08-20 13:39:03 +00:00

log.c

* server/log.c (log_ctime): Fix syntax error in r1931452

2026-01-21 11:09:55 +00:00

main.c

core: Follow up to r1908393: comment about where ap_server_conf is set.

2023-03-15 10:42:57 +00:00

Makefile.in

Remove apreq from trunk per PMC vote:

2026-04-23 16:08:21 +00:00

mpm_common.c

core: Follow up to r1902728: ap_max_mem_free early setting.

2022-08-18 10:44:52 +00:00

mpm_fdqueue.c

mpm_fdqueue: return EOF for ap_queue_interrupt_*() when terminated.

2021-07-22 15:48:03 +00:00

mpm_fdqueue.h

mpm_fdqueue: return EOF for ap_queue_interrupt_*() when terminated.

2021-07-22 15:48:03 +00:00

mpm_unix.c

OpenBSD doesn't support connect() to INADDR_ANY and returns EINVAL (22),

2026-08-05 09:00:00 +00:00

NWGNUmakefile

Updated typo NWGNUmakefile

2024-01-24 14:44:49 +00:00

protocol.c

* modules/http/http_filters.c (validate_status_line): Only accept

2026-08-10 12:49:40 +00:00

provider.c

Optimize 'ap_list_provider_names'.

2020-11-07 18:59:15 +00:00

request.c

windows: expand for things like 8.3 short names

2026-09-29 08:32:36 +00:00

scoreboard.c

Fix variable declaration warning in scoreboard.c

2025-02-14 09:23:28 +00:00

ssl.c

* optimizing hook check as suggested by Yann.

2021-09-09 14:42:48 +00:00

util_cfgtree.c

…

util_charset.c

Move comment from .c to .h in order to make use of it in doxygen.

2014-07-19 13:36:52 +00:00

util_cookies.c

remove session cookie consistently

2026-09-29 08:21:44 +00:00

util_debug.c

config: follow up to r1809302.

2017-09-22 13:13:44 +00:00

util_ebcdic.c

Missing va_end spotted by cppcheck

2014-08-21 06:56:40 +00:00

util_etag.c

copy all the chars in ETag, included the last '"'

2026-02-20 14:26:51 +00:00

util_expr_eval.c

restrict per-dir file funcs centrally

2026-06-05 10:27:34 +00:00

util_expr_parse.c

* server/util_expr_parse.c (yyparse): Fix typo in comment.

2024-02-02 14:49:06 +00:00

util_expr_parse.h

* server/util_expr_parse.[ch]: Regenerate after r1869724.

2019-11-13 08:02:43 +00:00

util_expr_parse.y

Non terminal cannot have string aliases (only tokens appear in error

2019-11-13 08:01:13 +00:00

util_expr_private.h

ap_expr: follow up to r1810605.

2017-10-04 16:18:46 +00:00

util_expr_scan.c

Follow up to rr1810605 and r1811104.

2017-10-04 16:20:02 +00:00

util_expr_scan.l

Fix spelling errors found by codespell. [skip ci]

2020-02-13 18:15:57 +00:00

util_fcgi.c

fix crash in util_fcgi.c

2016-12-21 16:19:26 +00:00

util_filter.c

util_filter: More useful logging for brigade setaside/reinstate/adopt.

2023-07-07 11:00:34 +00:00

util_md5.c

core: Remove support for the Content-MD5 header, removed in RFC7231.

2020-07-03 12:44:53 +00:00

util_mutex.c

Save a few bytes of memory when registering Mutex

2020-10-04 07:21:59 +00:00

util_pcre.c

ap_regname: restrict to reasonable captures

2026-06-05 10:17:58 +00:00

util_regex.c

Follow up to r1873941: define AP_REG_NO_DEFAULT for raw ap_regcomp() usage.

2020-02-16 23:08:32 +00:00

util_script.c

core: Add ap_cstr_stripws() to strip trailing whitespace from a

2026-09-14 11:05:50 +00:00

util_time.c

core: Add millisecond support to ErrorLogFormat time specifiers

2026-01-21 11:05:12 +00:00

util_xml.c

core: Make sure and check that LimitXMLRequestBody fits in system memory.

2022-03-07 13:36:10 +00:00

util.c

core: Add ap_cstr_stripws() to strip trailing whitespace from a

2026-09-14 11:05:50 +00:00

vhost.c

fix StrictHostCheck crash w/ HTTP/1.0

2021-04-17 20:13:28 +00:00