From: Eric Covener <covener@apache.org>
Date: Sun, 26 Apr 2026 15:50:50 +0000 (+0000)
Subject: Merge r1933342 from trunk:
X-Git-Tag: 2.4.67-rc1-candidate~12
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=b8def8fe323f7f67d0e03bb83c67d66bd8d7fcb2;p=thirdparty%2Fapache%2Fhttpd.git

Merge r1933342 from trunk:

fix ajp_msg_get_string buffer checks



git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1933343 13f79535-47bb-0310-9956-ffa450edef68
---

diff --git a/modules/proxy/ajp_msg.c b/modules/proxy/ajp_msg.c
index 36533c5905..3d4186a521 100644
--- a/modules/proxy/ajp_msg.c
+++ b/modules/proxy/ajp_msg.c
@@ -507,7 +507,12 @@ apr_status_t ajp_msg_get_string(ajp_msg_t *msg, const char **rvalue)
     status = ajp_msg_get_uint16(msg, &size);
     start = msg->pos;
 
-    if ((status != APR_SUCCESS) || (size + start > msg->max_size)) {
+    if ((status != APR_SUCCESS) || (size + start >= msg->len)) {
+        return ajp_log_overflow(msg, "ajp_msg_get_string");
+    }
+
+    /* Verify that the expected null terminator is actually present */
+    if (msg->buf[start + size] != '\0') {
         return ajp_log_overflow(msg, "ajp_msg_get_string");
     }