From aa6c438ce8a1b1798235183266ee4b53184cd0ca Mon Sep 17 00:00:00 2001 From: arshiya tabasum Date: Mon, 13 Jul 2026 14:06:05 +0530 Subject: [PATCH] reject too-short PROXY v2 address length in mod_remoteip --- modules/metadata/mod_remoteip.c | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/modules/metadata/mod_remoteip.c b/modules/metadata/mod_remoteip.c index 27a42d3cd37..c99ef25da26 100644 --- a/modules/metadata/mod_remoteip.c +++ b/modules/metadata/mod_remoteip.c @@ -954,6 +954,13 @@ static remoteip_parse_status_t remoteip_process_v2_header(conn_rec *c, case 0x01: /* PROXY command */ switch (hdr->v2.fam) { case 0x11: /* TCPv4 */ + if (ntohs(hdr->v2.len) < sizeof(hdr->v2.addr.ip4)) { + ap_log_cerror(APLOG_MARK, APLOG_ERR, 0, c, APLOGNO() + "RemoteIPProxyProtocol: address length %hu " + "too short for TCPv4", + (unsigned short)ntohs(hdr->v2.len)); + return HDR_ERROR; + } ret = apr_sockaddr_info_get(&conn_conf->client_addr, NULL, APR_INET, ntohs(hdr->v2.addr.ip4.src_port), @@ -971,6 +978,13 @@ static remoteip_parse_status_t remoteip_process_v2_header(conn_rec *c, case 0x21: /* TCPv6 */ #if APR_HAVE_IPV6 + if (ntohs(hdr->v2.len) < sizeof(hdr->v2.addr.ip6)) { + ap_log_cerror(APLOG_MARK, APLOG_ERR, 0, c, APLOGNO() + "RemoteIPProxyProtocol: address length %hu " + "too short for TCPv6", + (unsigned short)ntohs(hdr->v2.len)); + return HDR_ERROR; + } ret = apr_sockaddr_info_get(&conn_conf->client_addr, NULL, APR_INET6, ntohs(hdr->v2.addr.ip6.src_port),