svn commit: r1936263 - in httpd/httpd/trunk: changes-entries modules/filters

Author: jorton
Date: Fri Jul 17 12:12:54 2026
New Revision: 1936263

Log:
mod_substitute: reject overflow values in SubstituteMaxLineLength

* modules/filters/mod_substitute.c (set_max_line_length): Check that
  the parsed value does not exceed APR_INT64_MAX / multiplier before
  applying the K/M/G suffix, to avoid signed integer overflow UB.

Assisted-by: Claude Sonnet 4.6 <[email protected]>
GitHub: PR #685

Added:
   httpd/httpd/trunk/changes-entries/substitute-maxlinelength-overflow.txt
Modified:
   httpd/httpd/trunk/modules/filters/mod_substitute.c

Added: httpd/httpd/trunk/changes-entries/substitute-maxlinelength-overflow.txt
==============================================================================
--- /dev/null	00:00:00 1970	(empty, because file is newly added)
+++ httpd/httpd/trunk/changes-entries/substitute-maxlinelength-overflow.txt	Fri Jul 17 12:12:54 2026	(r1936263)
@@ -0,0 +1,2 @@
+  *) mod_substitute: Fix SubstituteMaxLineLength to reject values too
+     large for the K/M/G suffix.  [Joe Orton]

Modified: httpd/httpd/trunk/modules/filters/mod_substitute.c
==============================================================================
--- httpd/httpd/trunk/modules/filters/mod_substitute.c	Fri Jul 17 12:12:40 2026	(r1936262)
+++ httpd/httpd/trunk/modules/filters/mod_substitute.c	Fri Jul 17 12:12:54 2026	(r1936263)
@@ -777,12 +777,18 @@ static const char *set_max_line_length(c
     rv = apr_strtoff(&max, arg, &end, 10);
     if (rv == APR_SUCCESS) {
         if ((*end == 'K' || *end == 'k') && !end[1]) {
+            if (max > APR_INT64_MAX / KBYTE)
+                return "SubstituteMaxLineLength value too large";
             max *= KBYTE;
         }
         else if ((*end == 'M' || *end == 'm') && !end[1]) {
+            if (max > APR_INT64_MAX / MBYTE)
+                return "SubstituteMaxLineLength value too large";
             max *= MBYTE;
         }
         else if ((*end == 'G' || *end == 'g') && !end[1]) {
+            if (max > APR_INT64_MAX / GBYTE)
+                return "SubstituteMaxLineLength value too large";
             max *= GBYTE;
         }
         else if (*end && /* neither empty nor [Bb] */