From 0b865cd062c70327f58b777a4c4ac354a5f2fdd0 Mon Sep 17 00:00:00 2001 From: Arturo Bernal Date: Thu, 22 Oct 2026 15:34:17 +0200 Subject: [PATCH] mod_substitute: Fix an integer overflow that can happen in very special setups. do_pattmatch() kept the length of a line in an int, which is converted to a much larger apr_size_t for ap_regexec_len() when the line is 2 GiB or longer. Use apr_size_t for it. Backport of r1900307 from trunk. PR: 66034 --- changes-entries/pr66034.txt | 2 ++ modules/filters/mod_substitute.c | 2 +- 2 files changed, 3 insertions(+), 1 deletion(-) create mode 100644 changes-entries/pr66034.txt diff --git a/changes-entries/pr66034.txt b/changes-entries/pr66034.txt new file mode 100644 index 00000000000..125cdc3f8e5 --- /dev/null +++ b/changes-entries/pr66034.txt @@ -0,0 +1,2 @@ + *) mod_substitute: Fix an integer overflow that can happen in very special + setups. PR 66034 [Ruediger Pluem] diff --git a/modules/filters/mod_substitute.c b/modules/filters/mod_substitute.c index 0b3dc806a4a..769d45b48cb 100644 --- a/modules/filters/mod_substitute.c +++ b/modules/filters/mod_substitute.c @@ -275,7 +275,7 @@ static apr_status_t do_pattmatch(ap_filter_t *f, apr_bucket *inb, } } else if (script->regexp) { - int left = bytes; + apr_size_t left = bytes; const char *pos = buff; char *repl; apr_size_t space_left = cfg->max_line_length;