svn commit: r1936813 - in apr/apr-util/branches/1.6.x: . memcache

Author: covener
Date: Mon Aug  3 12:33:18 2026
New Revision: 1936813

Log:
Merge r1936812 from aprutil 1.7.x:

Merge r1936811 from apr trunk:

apr_memcache: error checking

Reviewed By: covener, jorton, jfclere

Modified:
   apr/apr-util/branches/1.6.x/   (props changed)
   apr/apr-util/branches/1.6.x/memcache/apr_memcache.c

Modified: apr/apr-util/branches/1.6.x/memcache/apr_memcache.c
==============================================================================
--- apr/apr-util/branches/1.6.x/memcache/apr_memcache.c	Mon Aug  3 12:32:40 2026	(r1936812)
+++ apr/apr-util/branches/1.6.x/memcache/apr_memcache.c	Mon Aug  3 12:33:18 2026	(r1936813)
@@ -595,6 +595,11 @@ static apr_status_t get_server_line(apr_
     conn->blen = bsize;
     conn->buffer[bsize] = '\0';
 
+    /* Validate CRLF line termination to prevent integer underflow attacks */
+    if (bsize < 2 || conn->buffer[bsize-2] != '\r' || conn->buffer[bsize-1] != '\n') {
+        return APR_EGENERAL;
+    }
+
     return apr_brigade_cleanup(conn->tb);
 }
 
@@ -1087,9 +1092,14 @@ apr_memcache_version(apr_memcache_server
     }
 
     if (strncmp(MS_VERSION, conn->buffer, MS_VERSION_LEN) == 0) {
-        *baton = apr_pstrmemdup(p, conn->buffer+MS_VERSION_LEN+1, 
-                                conn->blen - MS_VERSION_LEN - 2);
-        rv = APR_SUCCESS;
+        if (conn->blen < MS_VERSION_LEN + 2) {
+            rv = APR_EGENERAL;
+        }
+        else {
+            *baton = apr_pstrmemdup(p, conn->buffer+MS_VERSION_LEN+1, 
+                                    conn->blen - MS_VERSION_LEN - 2);
+            rv = APR_SUCCESS;
+       } 
     }
     else {
         rv = APR_EGENERAL;
@@ -1555,23 +1565,35 @@ apr_memcache_multgetp(apr_memcache_t *mc
 static const char *stat_read_string(apr_pool_t *p, char *buf, apr_size_t len)
 {
     /* remove trailing \r\n and null char */
+    if (len < 2) {
+        return apr_pstrdup(p, "");
+    }
     return apr_pstrmemdup(p, buf, len-2);
 }
 
 static apr_uint32_t stat_read_uint32(apr_pool_t *p, char *buf, apr_size_t  len)
 {
+    if (len < 2) {
+        return 0;
+    }
     buf[len-2] = '\0';
     return atoi(buf);
 }
 
 static apr_uint64_t stat_read_uint64(apr_pool_t *p, char *buf, apr_size_t  len)
 {
+    if (len < 2) {
+        return 0;
+    }
     buf[len-2] = '\0';
     return apr_atoi64(buf);
 }
 
 static apr_time_t stat_read_time(apr_pool_t *p, char *buf, apr_size_t  len)
 {
+    if (len < 2) {
+        return 0;
+    }
     buf[len-2] = '\0';
     return apr_time_from_sec(atoi(buf));
 }
@@ -1583,6 +1605,9 @@ static apr_time_t stat_read_rtime(apr_po
     char *usecs;
     const char *sep = ":.";
 
+    if (len < 2) {
+        return apr_time_make(0, 0);
+    }
     buf[len-2] = '\0';
 
     secs = apr_strtok(buf, sep, &tok);