You are viewing a plain text version of this content. The canonical link for it is here.
Posted to cvs@httpd.apache.org by ic...@apache.org on 2026/05/07 09:49:31 UTC
svn commit: r1933905 - in httpd/httpd/branches/2.4.x: . modules/http2
Author: icing
Date: Thu May 7 09:49:31 2026
New Revision: 1933905
Log:
merge /httpd/httpd/trunk:r1933903
mod_proxy_http2: fix buffer overflow in link mapping
Modified:
httpd/httpd/branches/2.4.x/ (props changed)
httpd/httpd/branches/2.4.x/modules/http2/h2_proxy_util.c
Modified: httpd/httpd/branches/2.4.x/modules/http2/h2_proxy_util.c
==============================================================================
--- httpd/httpd/branches/2.4.x/modules/http2/h2_proxy_util.c Thu May 7 09:46:23 2026 (r1933904)
+++ httpd/httpd/branches/2.4.x/modules/http2/h2_proxy_util.c Thu May 7 09:49:31 2026 (r1933905)
@@ -966,11 +966,8 @@ static void map_link(link_ctx *ctx)
apr_cpystrn(buffer, ctx->p_server_uri, sizeof(buffer));
buffer_len = ctx->psu_len;
}
- if (need_len > sizeof(buffer)) {
- ap_log_rerror(APLOG_MARK, APLOG_WARNING, 0, ctx->r, APLOGNO(03482)
- "link_reverse_map uri too long, skipped: %s", ctx->s);
- return;
- }
+ if (need_len > sizeof(buffer))
+ goto out;
apr_cpystrn(buffer + buffer_len, ctx->s + ctx->link_start, link_len + 1);
if (!prepend_p_server
&& strcmp(ctx->real_backend_uri, ctx->p_server_uri)
@@ -979,6 +976,9 @@ static void map_link(link_ctx *ctx)
* to work, we need to use the proxy uri */
int path_start = ctx->link_start + ctx->rbu_len;
link_len -= ctx->rbu_len;
+ need_len = ctx->psu_len + link_len;
+ if (need_len > sizeof(buffer))
+ goto out;
memcpy(buffer, ctx->p_server_uri, ctx->psu_len);
memcpy(buffer + ctx->psu_len, ctx->s + path_start, link_len);
buffer_len = ctx->psu_len + link_len;
@@ -999,6 +999,11 @@ static void map_link(link_ctx *ctx)
}
subst_str(ctx, ctx->link_start, ctx->link_end, mapped);
}
+out:
+ if (need_len > sizeof(buffer)) {
+ ap_log_rerror(APLOG_MARK, APLOG_WARNING, 0, ctx->r, APLOGNO(03482)
+ "link_reverse_map uri too long, skipped: %s", ctx->s);
+ }
}
}