Skip to content

Various fixes #685

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
notroj wants to merge 7 commits into from
Closed

Various fixes #685

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
e7b49ae
mod_remoteip: fix NULL dereference with PROXY v2 LOCAL command
notroj Jul 17, 2026
ac2deae
mod_ssl: fix NULL dereference in OCSP responder URI parsing
notroj Jul 17, 2026
4d8d051
mod_cern_meta: reject HTTP framing headers in metadata files
notroj Jul 17, 2026
a1f12b7
mod_ldap: fix race in LDAP URL cache child cache access
notroj Jul 17, 2026
b85e024
mod_ssl: fix set_challenge_creds() to return rv on failure
notroj Jul 17, 2026
62c9f8f
mod_substitute: reject overflow values in SubstituteMaxLineLength
notroj Jul 17, 2026
d1e04e6
mod_substitute: fix heap over-read in set_pattern() delimiter scanning
notroj Jul 17, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions changes-entries/cern-meta-header-injection.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,2 @@
*) mod_cern_meta: Reject HTTP framing headers in metadata files to prevent
response splitting. [Joe Orton]
2 changes: 2 additions & 0 deletions changes-entries/ldap-url-cache-uaf.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,2 @@
*) mod_ldap: Fix intermittent worker crashes under concurrent
LDAP-authenticated requests. [Joe Orton]
2 changes: 2 additions & 0 deletions changes-entries/remoteip-proxy-v2-local.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,2 @@
*) mod_remoteip: Fix crash with PROXY v2 LOCAL command and
RemoteIPProxyProtocol enabled. [Joe Orton]
2 changes: 2 additions & 0 deletions changes-entries/substitute-maxlinelength-overflow.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,2 @@
*) mod_substitute: Fix SubstituteMaxLineLength to reject values too
large for the K/M/G suffix. [Joe Orton]
2 changes: 2 additions & 0 deletions changes-entries/substitute-pattern-oob-read.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,2 @@
*) mod_substitute: Fix crash or misbehaviour when loading a Substitute
directive with a missing closing delimiter. [Joe Orton]
10 changes: 8 additions & 2 deletions modules/filters/mod_substitute.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -679,7 +679,7 @@ static const char *set_pattern(cmd_parms *cmd, void *cfg, const char *line)
if (delim)
from = ++ourline;
if (from) {
if (*ourline != delim) {
if (*ourline && *ourline != delim) {
while (*++ourline && *ourline != delim);
}
if (*ourline) {
Expand All @@ -688,7 +688,7 @@ static const char *set_pattern(cmd_parms *cmd, void *cfg, const char *line)
}
}
if (to) {
if (*ourline != delim) {
if (*ourline && *ourline != delim) {
while (*++ourline && *ourline != delim);
}
if (*ourline) {
Expand Down Expand Up @@ -777,12 +777,18 @@ static const char *set_max_line_length(cmd_parms *cmd, void *cfg, const char *ar
rv = apr_strtoff(&max, arg, &end, 10);
if (rv == APR_SUCCESS) {
if ((*end == 'K' || *end == 'k') && !end[1]) {
if (max > APR_INT64_MAX / KBYTE)
return "SubstituteMaxLineLength value too large";
max *= KBYTE;
}
else if ((*end == 'M' || *end == 'm') && !end[1]) {
if (max > APR_INT64_MAX / MBYTE)
return "SubstituteMaxLineLength value too large";
max *= MBYTE;
}
else if ((*end == 'G' || *end == 'g') && !end[1]) {
if (max > APR_INT64_MAX / GBYTE)
return "SubstituteMaxLineLength value too large";
max *= GBYTE;
}
else if (*end && /* neither empty nor [Bb] */
Expand Down
Loading