From: Joe Orton <jorton@apache.org>
Date: Fri, 17 Jul 2026 12:13:04 +0000 (+0000)
Subject: mod_substitute: fix heap over-read in set_pattern() delimiter scanning
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=cf75baf6a656bf810eb9375b6338557df58bbb2b;p=thirdparty%2Fapache%2Fhttpd.git

mod_substitute: fix heap over-read in set_pattern() delimiter scanning

* modules/filters/mod_substitute.c (set_pattern): Guard the
  pre-incrementing delimiter scan loops with a NUL check, preventing
  a read past the end of the allocation when the from or to field has
  no closing delimiter.

Assisted-by: Claude Sonnet 4.6 <noreply@anthropic.com>
GitHub: closes #685


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1936264 13f79535-47bb-0310-9956-ffa450edef68
---

diff --git a/changes-entries/substitute-pattern-oob-read.txt b/changes-entries/substitute-pattern-oob-read.txt
new file mode 100644
index 0000000000..55eea6f041
--- /dev/null
+++ b/changes-entries/substitute-pattern-oob-read.txt
@@ -0,0 +1,2 @@
+  *) mod_substitute: Fix crash or misbehaviour when loading a Substitute
+     directive with a missing closing delimiter.  [Joe Orton]
diff --git a/modules/filters/mod_substitute.c b/modules/filters/mod_substitute.c
index ada62a6da1..2533d7dcd0 100644
--- a/modules/filters/mod_substitute.c
+++ b/modules/filters/mod_substitute.c
@@ -679,7 +679,7 @@ static const char *set_pattern(cmd_parms *cmd, void *cfg, const char *line)
     if (delim)
         from = ++ourline;
     if (from) {
-        if (*ourline != delim) {
+        if (*ourline && *ourline != delim) {
             while (*++ourline && *ourline != delim);
         }
         if (*ourline) {
@@ -688,7 +688,7 @@ static const char *set_pattern(cmd_parms *cmd, void *cfg, const char *line)
         }
     }
     if (to) {
-        if (*ourline != delim) {
+        if (*ourline && *ourline != delim) {
             while (*++ourline && *ourline != delim);
         }
         if (*ourline) {