svn commit: r1936357 - httpd/httpd/trunk/modules/metadata

Author: jorton
Date: Mon Jul 20 10:08:18 2026
New Revision: 1936357

Log:
mod_remoteip: Validate v2 PROXY protocol address length

* modules/metadata/mod_remoteip.c
  (remoteip_get_v2_len): Move definition before first use.
  (remoteip_parse_v2_header): Add length validation for TCPv4
  and TCPv6 address families before parsing, returning HDR_ERROR
  if the header length is too short.

Submitted by: arshiya tabasum <arshi bugqore.com>
GitHub: closes #683

Modified:
   httpd/httpd/trunk/modules/metadata/mod_remoteip.c

Modified: httpd/httpd/trunk/modules/metadata/mod_remoteip.c
==============================================================================
--- httpd/httpd/trunk/modules/metadata/mod_remoteip.c	Mon Jul 20 10:08:04 2026	(r1936356)
+++ httpd/httpd/trunk/modules/metadata/mod_remoteip.c	Mon Jul 20 10:08:18 2026	(r1936357)
@@ -931,6 +931,12 @@ static int remoteip_hook_pre_connection(
     return OK;
 }
 
+/** Return length for a v2 protocol header. */
+static apr_size_t remoteip_get_v2_len(proxy_header *hdr)
+{
+    return ntohs(hdr->v2.len);
+}
+
 /* Binary format:
  * <sig><cmd><proto><addr-len><addr>
  * sig = \x0D \x0A \x0D \x0A \x00 \x0D \x0A \x51 \x55 \x49 \x54 \x0A
@@ -956,6 +962,13 @@ static remoteip_parse_status_t remoteip_
         case 0x01: /* PROXY command */
             switch (hdr->v2.fam) {
                 case 0x11:  /* TCPv4 */
+                    if (remoteip_get_v2_len(hdr) < sizeof(hdr->v2.addr.ip4)) {
+                        ap_log_cerror(APLOG_MARK, APLOG_ERR, 0, c, APLOGNO()
+                                      "RemoteIPProxyProtocol: address length "
+                                      "%" APR_SIZE_T_FMT " too short for TCPv4",
+                                      remoteip_get_v2_len(hdr));
+                        return HDR_ERROR;
+                    }
                     ret = apr_sockaddr_info_get(&conn_conf->client_addr, NULL,
                                                 APR_INET,
                                                 ntohs(hdr->v2.addr.ip4.src_port),
@@ -973,6 +986,13 @@ static remoteip_parse_status_t remoteip_
 
                 case 0x21:  /* TCPv6 */
 #if APR_HAVE_IPV6
+                    if (remoteip_get_v2_len(hdr) < sizeof(hdr->v2.addr.ip6)) {
+                        ap_log_cerror(APLOG_MARK, APLOG_ERR, 0, c, APLOGNO()
+                                      "RemoteIPProxyProtocol: address length "
+                                      "%" APR_SIZE_T_FMT " too short for TCPv6",
+                                      remoteip_get_v2_len(hdr));
+                        return HDR_ERROR;
+                    }
                     ret = apr_sockaddr_info_get(&conn_conf->client_addr, NULL,
                                                 APR_INET6,
                                                 ntohs(hdr->v2.addr.ip6.src_port),
@@ -1019,12 +1039,6 @@ static remoteip_parse_status_t remoteip_
     return HDR_DONE;
 }
 
-/** Return length for a v2 protocol header. */
-static apr_size_t remoteip_get_v2_len(proxy_header *hdr)
-{
-    return ntohs(hdr->v2.len);
-}
-
 /** Determine if this is a v1 or v2 PROXY header.
  */
 static int remoteip_determine_version(conn_rec *c, const char *ptr)