Mailing-List: contact dev-help@httpd.apache.org; run by ezmlm
Precedence: bulk
Reply-To: dev@httpd.apache.org
Received-SPF: error (athena.apache.org: local policy)
Date: Fri, 21 Jun 2013 13:43:53 -0500
From: "William A. Rowe Jr." <wrowe@rowe-clan.net>
To: dev@httpd.apache.org
Cc: trawick@gmail.com
Subject: Re: [PATCH] ap_pregsub_ex and somewhat-limited ap_pregsub() to
 2.2.x branch
Message-ID: <20130621134353.36327d3b@hub>
In-Reply-To: 
 <CAKUrXK6=ivgHKU9bYi6V6+9X7f+yUkmUp+thXK4rOw-RRqPcbw@mail.gmail.com>
References: 
 <CAKUrXK6=ivgHKU9bYi6V6+9X7f+yUkmUp+thXK4rOw-RRqPcbw@mail.gmail.com>
Mime-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 7bit

On Fri, 21 Jun 2013 13:19:36 -0400
Jeff Trawick <trawick@gmail.com> wrote:

> Even with the CVE-2011-3607 it is still possible to DOS the server by
> consuming huge amounts of memory with mod_setenvif using a specially
> crafted configuration.
> 
> Here's a backport of an existing fix in 2.4.x which resolves the
> issue I reproduced.  Note that unlike in 2.4.x we need ap_pregsub to
> handle somewhat arbitrary string lengths.  I picked 64MB, which can
> be overridden at compile time.
> 
> http://people.apache.org/~trawick/ap_pregsub_ex_22x.txt
> 
> This is essentially a grab of ap_pregsub/ap_pregsub_ex from 2.4.x
> HEAD with the minimal required changes plus
> http://svn.apache.org/viewvc?view=revision&revision=1198966
> 
> See the XXX notes in the patch for apparent semantic changes which I
> probably need to back out.  (I haven't researched that yet.)
> 
> Normally we use STATUS to track this but I don't think it is as
> polished as we normally expect.  Still to do (tomorrow?): Investigate
> the XXX's, run the regression suite.
> 
> Concerns with the patch?
> 
> Interested in any of this in the final 2.0.x release?

I am happy to hold up a short while to adopt this patch.  I'm neutral
on adding it to 2.0.x but will certainly pause for it to be committed
if others agree and will review the 2.0.x backport.