svn commit: r1938748 - in httpd/httpd/trunk: modules/mappers test/pytest_suite/t/conf test/pytest_suite/tests/t/modules

[jo...@apache.org]

Author: jorton
Date: Thu Oct  1 18:20:13 2026
New Revision: 1938748

Log:
* modules/mappers/mod_speling.c (check_speling): Decline if the
  filename's trailing component is longer than r->uri.

* test/pytest_suite/t/conf/extra.conf.in: Add Alias /sp-oob.

* test/pytest_suite/tests/t/modules/test_speling.py
  (test_speling_short_uri_alias): New test.

Submitted by: arshiya tabasum <arshi bugqore.com>
GitHub: closes #778

Modified:
   httpd/httpd/trunk/modules/mappers/mod_speling.c
   httpd/httpd/trunk/test/pytest_suite/t/conf/extra.conf.in
   httpd/httpd/trunk/test/pytest_suite/tests/t/modules/test_speling.py

Modified: httpd/httpd/trunk/modules/mappers/mod_speling.c
==============================================================================
--- httpd/httpd/trunk/modules/mappers/mod_speling.c	Thu Oct  1 16:08:35 2026	(r1938747)
+++ httpd/httpd/trunk/modules/mappers/mod_speling.c	Thu Oct  1 18:20:13 2026	(r1938748)
@@ -255,6 +255,17 @@ static int check_speling(request_rec *r)
     urlen = strlen(r->uri);
     pglen = strlen(postgood);
 
+    /*
+     * postgood is meant to be a trailing substring of r->uri. When a mapper
+     * (e.g. Alias or a RewriteRule) points a short URI at a file whose base
+     * name is longer, postgood is longer than r->uri and urlen - pglen goes
+     * negative; r->uri + (urlen - pglen) would then read before the start of
+     * the buffer. Bail out first so the suffix compare stays in bounds.
+     */
+    if (pglen > urlen) {
+        return DECLINED;
+    }
+
     /* Check to see if the URL pieces add up */
     if (strcmp(postgood, r->uri + (urlen - pglen))) {
         return DECLINED;

Modified: httpd/httpd/trunk/test/pytest_suite/t/conf/extra.conf.in
==============================================================================
--- httpd/httpd/trunk/test/pytest_suite/t/conf/extra.conf.in	Thu Oct  1 16:08:35 2026	(r1938747)
+++ httpd/httpd/trunk/test/pytest_suite/t/conf/extra.conf.in	Thu Oct  1 18:20:13 2026	(r1938748)
@@ -1538,6 +1538,10 @@ LimitRequestFields    32
       CheckSpelling on
       CheckCaseOnly on
    </Directory>
+   # Point a short URI at a longer, nonexistent base name in a CheckSpelling
+   # directory. This exercised the r->uri + (urlen - pglen) underflow in
+   # check_speling(); the server must answer cleanly rather than read OOB.
+   Alias /sp-oob @SERVERROOT@/htdocs/modules/speling/nocase/nonexistent-long-name.html
 </IfModule>
 
 <IfModule mod_actions.c>

Modified: httpd/httpd/trunk/test/pytest_suite/tests/t/modules/test_speling.py
==============================================================================
--- httpd/httpd/trunk/test/pytest_suite/tests/t/modules/test_speling.py	Thu Oct  1 16:08:35 2026	(r1938747)
+++ httpd/httpd/trunk/test/pytest_suite/tests/t/modules/test_speling.py	Thu Oct  1 18:20:13 2026	(r1938748)
@@ -59,3 +59,17 @@ def test_speling(http, prefix, code_idx,
     # Only redirect responses carry a corrected-filename body.
     if expected not in (200, 404):
         assert t_cmp(r.text, _REDIRECT_BODY), "Redirect ok"
+
+
+@need_module("mod_speling")
+def test_speling_short_uri_alias(http):
+    """Regression for the check_speling() out-of-bounds read.
+
+    ``Alias /sp-oob`` maps a short URI to a longer, nonexistent base name in
+    a CheckSpelling directory. postgood (the base name) is then longer than
+    r->uri, so r->uri + (urlen - pglen) underflowed and strcmp read before
+    the start of the buffer. The server must answer cleanly (404) instead of
+    crashing or reading out of bounds.
+    """
+    r = http.GET("/sp-oob")
+    assert t_cmp(r.status_code, 404), "short-URI alias must not read OOB"