dac09acc90
Resolves: RHEL-186226 - httpd: Apache HTTP Server: Heap-based Buffer Overflow via malicious backend servers (CVE-2026-34356) Resolves: RHEL-182580 - httpd: incomplete fix for CVE-2023-38709 (CVE-2024-42516) Resolves: RHEL-186187 - httpd: mod_proxy_html buffer handling vulnerability (CVE-2026-34355) Resolves: RHEL-175632 - httpd: mod_dav_lock uses wrong lock discovery (CVE-2026-29169) Resolves: RHEL-186189 - mod_xml2enc: fix bblen accounting in fix_skipto (CVE-2026-42536) Resolves: RHEL-186156 - httpd: fix OCSP write buffer advancement bug in mod_ssl (CVE-2026-44185) Resolves: RHEL-191249 - httpd: Apache HTTP Server: Out-of-bounds Read in mod_headers and mod_mime (CVE-2026-43951) Resolves: RHEL-193128 - httpd: Apache HTTP Server: Denial of Service in mod_proxy_ftp via attacker-controlled FTP server (CVE-2026-44186) Also addresses CVE-2026-24072, CVE-2026-33006, CVE-2026-42535, CVE-2026-44119
110 lines
4.1 KiB
Diff
110 lines
4.1 KiB
Diff
From 3311011c179eebf14d258e81cfac7dcff90d509e Mon Sep 17 00:00:00 2001
|
|
From: Eric Covener <covener@apache.org>
|
|
Date: Fri, 5 Jun 2026 10:26:23 +0000
|
|
Subject: [PATCH] Merge r1935014 from trunk:
|
|
|
|
ap_regname: restrict to reasonable captures
|
|
|
|
Reviewed By: covener, gbechis, jfclere
|
|
|
|
|
|
|
|
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1935015 13f79535-47bb-0310-9956-ffa450edef68
|
|
---
|
|
include/ap_regex.h | 2 ++
|
|
modules/proxy/mod_proxy.c | 4 +++-
|
|
server/core.c | 12 +++++++++---
|
|
server/util_pcre.c | 11 ++++++++++-
|
|
4 files changed, 24 insertions(+), 5 deletions(-)
|
|
|
|
diff --git a/include/ap_regex.h b/include/ap_regex.h
|
|
index 50d5abaa0f..d6afbb17d7 100644
|
|
--- a/include/ap_regex.h
|
|
+++ b/include/ap_regex.h
|
|
@@ -204,6 +204,8 @@ AP_DECLARE(apr_size_t) ap_regerror(int errcode, const ap_regex_t *preg,
|
|
* @param prefix An optional prefix to add to the returned names. AP_REG_MATCH
|
|
* is the recommended prefix.
|
|
* @param upper If non zero, uppercase the names
|
|
+ * @return number of regex backrefernces returned, -1 for error
|
|
+ * for successful match, AP_REG_NOMATCH otherwise
|
|
*/
|
|
AP_DECLARE(int) ap_regname(const ap_regex_t *preg,
|
|
apr_array_header_t *names, const char *prefix,
|
|
diff --git a/modules/proxy/mod_proxy.c b/modules/proxy/mod_proxy.c
|
|
index 860041e928..491541af19 100644
|
|
--- a/modules/proxy/mod_proxy.c
|
|
+++ b/modules/proxy/mod_proxy.c
|
|
@@ -2883,7 +2883,9 @@ static const char *proxysection(cmd_parms *cmd, void *mconfig, const char *arg)
|
|
|
|
if (r) {
|
|
conf->refs = apr_array_make(cmd->pool, 8, sizeof(char *));
|
|
- ap_regname(r, conf->refs, AP_REG_MATCH, 1);
|
|
+ if (ap_regname(r, conf->refs, AP_REG_MATCH, 1) < 0) {
|
|
+ return "Error processing regex captures";
|
|
+ }
|
|
}
|
|
|
|
ap_add_per_proxy_conf(cmd->server, new_dir_conf);
|
|
diff --git a/server/core.c b/server/core.c
|
|
index 2b157d6c0e..fa179d2fb2 100644
|
|
--- a/server/core.c
|
|
+++ b/server/core.c
|
|
@@ -2533,7 +2533,9 @@ static const char *dirsection(cmd_parms *cmd, void *mconfig, const char *arg)
|
|
|
|
if (r) {
|
|
conf->refs = apr_array_make(cmd->pool, 8, sizeof(char *));
|
|
- ap_regname(r, conf->refs, AP_REG_MATCH, 1);
|
|
+ if (ap_regname(r, conf->refs, AP_REG_MATCH, 1) < 0) {
|
|
+ return "Error processing regex captures";
|
|
+ }
|
|
}
|
|
|
|
/* Make this explicit - the "/" root has 0 elements, that is, we
|
|
@@ -2614,7 +2616,9 @@ static const char *urlsection(cmd_parms *cmd, void *mconfig, const char *arg)
|
|
|
|
if (r) {
|
|
conf->refs = apr_array_make(cmd->pool, 8, sizeof(char *));
|
|
- ap_regname(r, conf->refs, AP_REG_MATCH, 1);
|
|
+ if (ap_regname(r, conf->refs, AP_REG_MATCH, 1) < 0) {
|
|
+ return "Error processing regex captures";
|
|
+ }
|
|
}
|
|
|
|
ap_add_per_url_conf(cmd->server, new_url_conf);
|
|
@@ -2701,7 +2705,9 @@ static const char *filesection(cmd_parms *cmd, void *mconfig, const char *arg)
|
|
|
|
if (r) {
|
|
conf->refs = apr_array_make(cmd->pool, 8, sizeof(char *));
|
|
- ap_regname(r, conf->refs, AP_REG_MATCH, 1);
|
|
+ if (ap_regname(r, conf->refs, AP_REG_MATCH, 1) < 0) {
|
|
+ return "Error processing regex captures";
|
|
+ }
|
|
}
|
|
|
|
ap_add_file_conf(cmd->pool, (core_dir_config *)mconfig, new_file_conf);
|
|
diff --git a/server/util_pcre.c b/server/util_pcre.c
|
|
index 0a9dc50112..46e82112a5 100644
|
|
--- a/server/util_pcre.c
|
|
+++ b/server/util_pcre.c
|
|
@@ -521,7 +521,16 @@ AP_DECLARE(int) ap_regname(const ap_regex_t *preg,
|
|
|
|
for (i = 0; i < namecount; i++) {
|
|
const char *offset = nametable + i * nameentrysize;
|
|
- int capture = ((offset[0] << 8) + offset[1]);
|
|
+ int capture = (((unsigned char)offset[0] << 8) + (unsigned char)offset[1]);
|
|
+
|
|
+ /* Sanity check: reject unreasonably large capture group numbers.
|
|
+ * PCRE allows up to 65535 groups, but such large numbers would
|
|
+ * cause excessive memory allocation. Limit to a reasonable maximum.
|
|
+ */
|
|
+ if (capture > 1024) {
|
|
+ return -1;
|
|
+ }
|
|
+
|
|
while (names->nelts <= capture) {
|
|
apr_array_push(names);
|
|
}
|
|
--
|
|
2.52.0
|
|
|