svn commit: r1936264 - in httpd/httpd/trunk: changes-entries modules/filters

Author: jorton
Date: Fri Jul 17 12:13:04 2026
New Revision: 1936264

Log:
mod_substitute: fix heap over-read in set_pattern() delimiter scanning

* modules/filters/mod_substitute.c (set_pattern): Guard the
  pre-incrementing delimiter scan loops with a NUL check, preventing
  a read past the end of the allocation when the from or to field has
  no closing delimiter.

Assisted-by: Claude Sonnet 4.6 <[email protected]>
GitHub: closes #685

Added:
   httpd/httpd/trunk/changes-entries/substitute-pattern-oob-read.txt
Modified:
   httpd/httpd/trunk/modules/filters/mod_substitute.c

Added: httpd/httpd/trunk/changes-entries/substitute-pattern-oob-read.txt
==============================================================================
--- /dev/null	00:00:00 1970	(empty, because file is newly added)
+++ httpd/httpd/trunk/changes-entries/substitute-pattern-oob-read.txt	Fri Jul 17 12:13:04 2026	(r1936264)
@@ -0,0 +1,2 @@
+  *) mod_substitute: Fix crash or misbehaviour when loading a Substitute
+     directive with a missing closing delimiter.  [Joe Orton]

Modified: httpd/httpd/trunk/modules/filters/mod_substitute.c
==============================================================================
--- httpd/httpd/trunk/modules/filters/mod_substitute.c	Fri Jul 17 12:12:54 2026	(r1936263)
+++ httpd/httpd/trunk/modules/filters/mod_substitute.c	Fri Jul 17 12:13:04 2026	(r1936264)
@@ -679,7 +679,7 @@ static const char *set_pattern(cmd_parms
     if (delim)
         from = ++ourline;
     if (from) {
-        if (*ourline != delim) {
+        if (*ourline && *ourline != delim) {
             while (*++ourline && *ourline != delim);
         }
         if (*ourline) {
@@ -688,7 +688,7 @@ static const char *set_pattern(cmd_parms
         }
     }
     if (to) {
-        if (*ourline != delim) {
+        if (*ourline && *ourline != delim) {
             while (*++ourline && *ourline != delim);
         }
         if (*ourline) {