mod_substitute: reject overflow values in SubstituteMaxLineLength

* modules/filters/mod_substitute.c (set_max_line_length): Check that
  the parsed value does not exceed APR_INT64_MAX / multiplier before
  applying the K/M/G suffix, to avoid signed integer overflow UB.

Assisted-by: Claude Sonnet 4.6 <noreply@anthropic.com>
GitHub: PR #685

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1936263 13f79535-47bb-0310-9956-ffa450edef68

diff --git a/changes-entries/substitute-maxlinelength-overflow.txt b/changes-entries/substitute-maxlinelength-overflow.txt
new file mode 100644 (file)
index 0000000..7ad5397
--- /dev/null
+++ b/changes-entries/substitute-maxlinelength-overflow.txt
@@ -0,0 +1,2 @@
+  *) mod_substitute: Fix SubstituteMaxLineLength to reject values too
+     large for the K/M/G suffix.  [Joe Orton]

diff --git a/modules/filters/mod_substitute.c b/modules/filters/mod_substitute.c
index 65ca5f95d01a4f86a4dbc3a4d6b87a9e95c77133..ada62a6da16de4baf8a27409664dc1eeab62cf52 100644 (file)
--- a/modules/filters/mod_substitute.c
+++ b/modules/filters/mod_substitute.c
@@ -777,12 +777,18 @@ static const char *set_max_line_length(cmd_parms *cmd, void *cfg, const char *ar
     rv = apr_strtoff(&max, arg, &end, 10);
     if (rv == APR_SUCCESS) {
         if ((*end == 'K' || *end == 'k') && !end[1]) {
+            if (max > APR_INT64_MAX / KBYTE)
+                return "SubstituteMaxLineLength value too large";
             max *= KBYTE;
         }
         else if ((*end == 'M' || *end == 'm') && !end[1]) {
+            if (max > APR_INT64_MAX / MBYTE)
+                return "SubstituteMaxLineLength value too large";
             max *= MBYTE;
         }
         else if ((*end == 'G' || *end == 'g') && !end[1]) {
+            if (max > APR_INT64_MAX / GBYTE)
+                return "SubstituteMaxLineLength value too large";
             max *= GBYTE;
         }
         else if (*end && /* neither empty nor [Bb] */