[Bug 70012] New: Substitute with empty replacement triggers subsequent Substitute empty reply

[bu...@apache.org]

https://bz.apache.org/bugzilla/show_bug.cgi?id=70012

            Bug ID: 70012
           Summary: Substitute with empty replacement triggers subsequent
                    Substitute empty reply
           Product: Apache httpd-2
           Version: 2.4.57
          Hardware: PC
                OS: Linux
            Status: NEW
          Severity: normal
          Priority: P2
         Component: mod_substitute
          Assignee: bugs@httpd.apache.org
          Reporter: benedikt.heine@3q.video
  Target Milestone: ---

Created attachment 40170
  --> https://bz.apache.org/bugzilla/attachment.cgi?id=40170&action=edit
Docker compose project with a reproducer

I had been trying to manipulate m3u8 files with Apache2 yesterday.

Curl just closes the connection:

$> curl http://localhost:8080/badfile.txt -v
* Host localhost:8080 was resolved.
* IPv6: ::1
* IPv4: 127.0.0.1
*   Trying [::1]:8080...
* Connected to localhost (::1) port 8080
> GET /badfile.txt HTTP/1.1
> Host: localhost:8080
> User-Agent: curl/8.7.1
> Accept: */*
> 
* Request completely sent off
* Empty reply from server
* Closing connection
curl: (52) Empty reply from server
$>


I've written a reproducer with docker-compose (attached).


Version: 2.4.58-1ubuntu8.8

-- 
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org

[Bug 70012] Substitute with empty replacement triggers subsequent Substitute empty reply

[bu...@apache.org]

https://bz.apache.org/bugzilla/show_bug.cgi?id=70012

--- Comment #1 from Benedikt Heine <be...@3q.video> ---
Oops, sorry hit the Bug Submit button while uploading the attachment.

The problem stems from a `Substitute "s/^##.*//"`, which just removes all
content in a single line.

If this runs, all other subsequent `Substitute` fail. If the bad substitution
does not change anything, subsequent `Substitute` work without any problem.

Also if the bad `Substitute "s/^##.*//"` is the only `Substitute`, which
matches everything is fine.

The workaround for me: `Substitute "s/^##.*/##/"` which empties out the
comments.

I don't know whether this is a known issue, I haven't found something similar
in the bugtracker and I haven't found a "known issue" in the mod_substitute
documentation.

The docker compose project uses httpd:2.4.66, so it's also a problem in latest.

-- 
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org

[Bug 70012] Substitute with empty replacement triggers subsequent Substitute empty reply

[bu...@apache.org]

https://bz.apache.org/bugzilla/show_bug.cgi?id=70012

--- Comment #2 from abernal <ab...@apache.org> ---
A fix and a regression test are available as a pull request:
https://github.com/apache/httpd/pull/806

The crash is in ap_varbuf_regsub() (server/util.c): when the result is empty
and the varbuf has no buffer yet, the terminating NUL is written to the shared
read-only empty string.

-- 
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org