httpd-cvs mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From s.@apache.org
Subject svn commit: r1227280 - in /httpd/httpd/branches/2.2.x: CHANGES STATUS server/util.c
Date Wed, 04 Jan 2012 19:45:22 GMT
Author: sf
Date: Wed Jan  4 19:45:22 2012
New Revision: 1227280

URL: http://svn.apache.org/viewvc?rev=1227280&view=rev
Log:
Merge fix for CVE-2011-3607:

Fix integer overflow in ap_pregsub()

Trunk fix: r1198940
Submitted by: Stefan Fritsch, Greg Ames
Reviewed by: Stefan Fritsch, Greg Ames, Eric Covener

Modified:
    httpd/httpd/branches/2.2.x/CHANGES
    httpd/httpd/branches/2.2.x/STATUS
    httpd/httpd/branches/2.2.x/server/util.c

Modified: httpd/httpd/branches/2.2.x/CHANGES
URL: http://svn.apache.org/viewvc/httpd/httpd/branches/2.2.x/CHANGES?rev=1227280&r1=1227279&r2=1227280&view=diff
==============================================================================
--- httpd/httpd/branches/2.2.x/CHANGES [utf-8] (original)
+++ httpd/httpd/branches/2.2.x/CHANGES [utf-8] Wed Jan  4 19:45:22 2012
@@ -6,6 +6,11 @@ Changes with Apache 2.2.22
      specification, preventing unexpected expansion of target URLs in
      some reverse proxy configurations.  [Joe Orton]
 
+  *) SECURITY: CVE-2011-3607 (cve.mitre.org)
+     Fix integer overflow in ap_pregsub() which, when the mod_setenvif module
+     is enabled, could allow local users to gain privileges via a .htaccess
+     file. [Stefan Fritsch, Greg Ames]
+
   *) core: Fix segfault in ap_send_interim_response(). PR 52315.
      [Stefan Fritsch]
 

Modified: httpd/httpd/branches/2.2.x/STATUS
URL: http://svn.apache.org/viewvc/httpd/httpd/branches/2.2.x/STATUS?rev=1227280&r1=1227279&r2=1227280&view=diff
==============================================================================
--- httpd/httpd/branches/2.2.x/STATUS (original)
+++ httpd/httpd/branches/2.2.x/STATUS Wed Jan  4 19:45:22 2012
@@ -112,11 +112,6 @@ PATCHES ACCEPTED TO BACKPORT FROM TRUNK:
       2.2.x patch: trunk patch works
     +1: sf, gregames, covener
 
-  * core: Fix integer overflow in ap_pregsub. CVE-2011-3607
-      Trunk patch: http://svn.apache.org/viewvc?rev=1198940&view=rev
-      2.2.x patch: http://people.apache.org/~sf/CVE-2011-3607.diff
-    +1: sf, gregames, covener
-
 PATCHES PROPOSED TO BACKPORT FROM TRUNK:
   [ New proposals should be added at the end of the list ]
 

Modified: httpd/httpd/branches/2.2.x/server/util.c
URL: http://svn.apache.org/viewvc/httpd/httpd/branches/2.2.x/server/util.c?rev=1227280&r1=1227279&r2=1227280&view=diff
==============================================================================
--- httpd/httpd/branches/2.2.x/server/util.c (original)
+++ httpd/httpd/branches/2.2.x/server/util.c Wed Jan  4 19:45:22 2012
@@ -82,6 +82,8 @@
 #define IS_SLASH(s) (s == '/')
 #endif
 
+/* same as APR_SIZE_MAX which doesn't appear until APR 1.3 */
+#define UTIL_SIZE_MAX (~((apr_size_t)0))
 
 /*
  * Examine a field value (such as a media-/content-type) string and return
@@ -366,7 +368,7 @@ AP_DECLARE(char *) ap_pregsub(apr_pool_t
     char *dest, *dst;
     char c;
     size_t no;
-    int len;
+    apr_size_t len;
 
     if (!source)
         return NULL;
@@ -391,6 +393,11 @@ AP_DECLARE(char *) ap_pregsub(apr_pool_t
             len++;
         }
         else if (no < nmatch && pmatch[no].rm_so < pmatch[no].rm_eo) {
+            if (UTIL_SIZE_MAX - len <= pmatch[no].rm_eo - pmatch[no].rm_so) {
+                ap_log_error(APLOG_MARK, APLOG_WARNING, 0, NULL,
+                             "integer overflow or out of memory condition." );
+                return NULL;
+            }
             len += pmatch[no].rm_eo - pmatch[no].rm_so;
         }
 



Mime
View raw message