Skip to content

mod_lua: fix stack write past apr_size_t in r:parsebody - #707

Open
arshsmith1 wants to merge 1 commit into
apache:trunkfrom
arshsmith1:lua-parsebody-off-t
Open

mod_lua: fix stack write past apr_size_t in r:parsebody#707
arshsmith1 wants to merge 1 commit into
apache:trunkfrom
arshsmith1:lua-parsebody-off-t

Conversation

@arshsmith1

Copy link
Copy Markdown

req_parsebody() declares size as an apr_size_t but hands lua_read_body() a (apr_off_t*)&size, and that callee stores the body length back through the pointer as an 8-byte apr_off_t, so on builds where apr_off_t is wider than apr_size_t (32-bit with large-file support) every multipart POST writes four bytes past the size object into adjacent stack. The sibling call in lua_ap_requestbody already reads into a real apr_off_t, so this multipart path is the only site that aliases the narrower type. Read the length into a local apr_off_t and narrow it into size, matching what the urlencoded branch just below already does.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant