From: Jim Jagielski <jim@apache.org>
Date: Mon, 27 Oct 2014 12:42:37 +0000 (+0000)
Subject: Merge r1628104, r1628918 from trunk:
X-Git-Tag: 2.4.11~226
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=51b43a3fbc79da8e1d3a17f2d260e10c406e59f7;p=thirdparty%2Fapache%2Fhttpd.git

Merge r1628104, r1628918 from trunk:

mod_substitute: Fix memory limitation in case of
regexp plus flatten.

The maxlen argument of ap_varbuf_regsub() is unsigned.
Passing in "AP_SUBST_MAX_LINE_LENGTH - vb.strlen"
in case vb.strlen got to big didn't result in the
expected error but instead was handled as a very big
maxlen.


Add CHANGES for r1628104.
(mod_substitue: Fix memory limitation in case of
regexp plus flatten.)

Submitted by: rjung
Reviewed/backported by: jim


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1634522 13f79535-47bb-0310-9956-ffa450edef68
---

diff --git a/CHANGES b/CHANGES
index 580b99b09b1..a9250e06762 100644
--- a/CHANGES
+++ b/CHANGES
@@ -2,6 +2,9 @@
 
 Changes with Apache 2.4.11
 
+  *) mod_substitute: Fix line length limitation in case of regexp plus flatten.
+     [Rainer Jung]
+  
   *) mod_proxy: Truncated character worker names are no longer fatal
      errors. PR53218. [Jim Jagielski]
 
diff --git a/STATUS b/STATUS
index 858b1774c0a..8f947edca90 100644
--- a/STATUS
+++ b/STATUS
@@ -102,12 +102,6 @@ RELEASE SHOWSTOPPERS:
 PATCHES ACCEPTED TO BACKPORT FROM TRUNK:
   [ start all new proposals below, under PATCHES PROPOSED. ]
 
-   * mod_substitute: Fix memory limitation in case of regexp plus flatten.
-     trunk patch: http://svn.apache.org/r1628104
-                  http://svn.apache.org/r1628918 (CHANGES)
-     2.4.x patch: trunk works
-     +1: rjung, covener, jim
-
    * mod_substitute: Make maximum line length configurable.
      trunk patch: http://svn.apache.org/r1628919
                   http://svn.apache.org/r1628950 (docs, adjust "compatibility")
diff --git a/modules/filters/mod_substitute.c b/modules/filters/mod_substitute.c
index 15cd8ee4131..0a8037b5e9b 100644
--- a/modules/filters/mod_substitute.c
+++ b/modules/filters/mod_substitute.c
@@ -235,9 +235,11 @@ static apr_status_t do_pattmatch(ap_filter_t *f, apr_bucket *inb,
                         have_match = 1;
                         if (script->flatten && !force_quick) {
                             /* copy bytes before the match */
+                            if (vb.strlen + regm[0].rm_so >= AP_SUBST_MAX_LINE_LENGTH)
+                                return APR_ENOMEM;
                             if (regm[0].rm_so > 0)
                                 ap_varbuf_strmemcat(&vb, pos, regm[0].rm_so);
-                            /* add replacement string */
+                            /* add replacement string, last argument is unsigned! */
                             rv = ap_varbuf_regsub(&vb, script->replacement, pos,
                                                   AP_MAX_REG_MATCH, regm,
                                                   AP_SUBST_MAX_LINE_LENGTH - vb.strlen);