Skip to content

Avoid UB trimming empty response header values - #749

Open
mcc0nnell wants to merge 1 commit into
apache:trunkfrom
mcc0nnell:fix/empty-header-trim-ub
Open

Avoid UB trimming empty response header values#749
mcc0nnell wants to merge 1 commit into
apache:trunkfrom
mcc0nnell:fix/empty-header-trim-ub

Conversation

@mcc0nnell

Copy link
Copy Markdown

This avoids undefined behavior when trimming trailing whitespace from empty header values.

Several response/header parsing paths initialized the trim pointer with &value[strlen(value) - 1] (or the equivalent l + strlen(l) - 1). For an empty value, that constructs a pointer before the start of the string object before the loop condition can reject it.

Use an end-exclusive pointer instead and only inspect end[-1] while end > value.

Updated paths:

  • mod_proxy_http
  • mod_proxy_uwsgi
  • mod_proxy_hcheck
  • server/util_script.c
  • mod_cern_meta

The proxy tests add backend responses containing a valid empty X-Empty: header for both HTTP proxy and uWSGI paths.

Validation against trunk 3ffb2beeb058fa88d0a7b0de8b93d21ac7ec5f66:

  • built and installed Apache/2.5.1-dev from this patched tree in a user-space prefix
  • all touched C paths compiled successfully
  • focused new regressions: 2/2 passed
  • complete test_03_response.py + test_05_uwsgi.py: 6/6 passed
  • git diff --check: clean

A small Clang UBSan/pointer-overflow reproducer also reports the original empty-value expression and is silent with the end-exclusive form.

I have not demonstrated a crash, out-of-bounds read/write, information disclosure, or other exploit primitive; this is a narrow UB hardening change.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant