34 lines
1.1 KiB
Diff
34 lines
1.1 KiB
Diff
From b8def8fe323f7f67d0e03bb83c67d66bd8d7fcb2 Mon Sep 17 00:00:00 2001
|
|
From: Eric Covener <covener@apache.org>
|
|
Date: Sun, 26 Apr 2026 15:50:50 +0000
|
|
Subject: [PATCH] Merge r1933342 from trunk:
|
|
|
|
fix ajp_msg_get_string buffer checks
|
|
|
|
|
|
|
|
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1933343 13f79535-47bb-0310-9956-ffa450edef68
|
|
---
|
|
modules/proxy/ajp_msg.c | 7 ++++++-
|
|
1 file changed, 6 insertions(+), 1 deletion(-)
|
|
|
|
diff --git a/modules/proxy/ajp_msg.c b/modules/proxy/ajp_msg.c
|
|
index 36533c59059..3d4186a521c 100644
|
|
--- a/modules/proxy/ajp_msg.c
|
|
+++ b/modules/proxy/ajp_msg.c
|
|
@@ -507,7 +507,12 @@ apr_status_t ajp_msg_get_string(ajp_msg_t *msg, const char **rvalue)
|
|
status = ajp_msg_get_uint16(msg, &size);
|
|
start = msg->pos;
|
|
|
|
- if ((status != APR_SUCCESS) || (size + start > msg->max_size)) {
|
|
+ if ((status != APR_SUCCESS) || (size + start >= msg->len)) {
|
|
+ return ajp_log_overflow(msg, "ajp_msg_get_string");
|
|
+ }
|
|
+
|
|
+ /* Verify that the expected null terminator is actually present */
|
|
+ if (msg->buf[start + size] != '\0') {
|
|
return ajp_log_overflow(msg, "ajp_msg_get_string");
|
|
}
|
|
|
|
|