* Use apr_size_t instead of int to avoid an overflow

PR: 66034

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1900307 13f79535-47bb-0310-9956-ffa450edef68

diff --git a/changes-entries/pr66034.txt b/changes-entries/pr66034.txt
new file mode 100644 (file)
index 0000000..125cdc3
--- /dev/null
+++ b/changes-entries/pr66034.txt
@@ -0,0 +1,2 @@
+  *) mod_substitute: Fix an integer overflow that can happen in very special
+     setups.  PR 66034 [Ruediger Pluem]

diff --git a/modules/filters/mod_substitute.c b/modules/filters/mod_substitute.c
index 58e696debba1586a07b2ebafe8c55cd2356ca85a..19819b8f23eccccc68e6a0cb4710e2c95e9dd7b7 100644 (file)
--- a/modules/filters/mod_substitute.c
+++ b/modules/filters/mod_substitute.c
@@ -309,7 +309,7 @@ static apr_status_t do_pattmatch(ap_filter_t *f, apr_bucket *inb,
                     }
                 }
                 else if (script->regexp) {
-                    int left = bytes;
+                    apr_size_t left = bytes;
                     const char *pos = buff;
                     char *repl;
                     apr_size_t space_left = cfg->max_line_length;