mod_substitute: fix heap over-read in set_pattern() delimiter scanning

* modules/filters/mod_substitute.c (set_pattern): Guard the
  pre-incrementing delimiter scan loops with a NUL check, preventing
  a read past the end of the allocation when the from or to field has
  no closing delimiter.

Assisted-by: Claude Sonnet 4.6 <noreply@anthropic.com>
GitHub: closes #685

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1936264 13f79535-47bb-0310-9956-ffa450edef68

diff --git a/changes-entries/substitute-pattern-oob-read.txt b/changes-entries/substitute-pattern-oob-read.txt
new file mode 100644 (file)
index 0000000..55eea6f
--- /dev/null
+++ b/changes-entries/substitute-pattern-oob-read.txt
@@ -0,0 +1,2 @@
+  *) mod_substitute: Fix crash or misbehaviour when loading a Substitute
+     directive with a missing closing delimiter.  [Joe Orton]

diff --git a/modules/filters/mod_substitute.c b/modules/filters/mod_substitute.c
index ada62a6da16de4baf8a27409664dc1eeab62cf52..2533d7dcd0499372473b460a3120fb15c8daed5f 100644 (file)
--- a/modules/filters/mod_substitute.c
+++ b/modules/filters/mod_substitute.c
@@ -679,7 +679,7 @@ static const char *set_pattern(cmd_parms *cmd, void *cfg, const char *line)
     if (delim)
         from = ++ourline;
     if (from) {
-        if (*ourline != delim) {
+        if (*ourline && *ourline != delim) {
             while (*++ourline && *ourline != delim);
         }
         if (*ourline) {
@@ -688,7 +688,7 @@ static const char *set_pattern(cmd_parms *cmd, void *cfg, const char *line)
         }
     }
     if (to) {
-        if (*ourline != delim) {
+        if (*ourline && *ourline != delim) {
             while (*++ourline && *ourline != delim);
         }
         if (*ourline) {