https://bz.apache.org/bugzilla/show_bug.cgi?id=70270
Bug ID: 70270
Summary: Sanity check breaks large environment
Product: Apache httpd-2
Version: 2.4.69
Hardware: All
OS: All
Status: NEW
Severity: blocker
Priority: P2
Component: mod_cgid
Assignee: [email protected]
Reporter: [email protected]
Target Milestone: ---
Created attachment 40223
--> https://bz.apache.org/bugzilla/attachment.cgi?id=40223&action=edit
Patch to address abirtrary environment size limit
Starting with apache 2.4.69, mod_cgid performs strict input sanity checks.
/* Sanity check the structure received. */
if (req->env_count > ENV_COUNT_MAX
|| req->filename_len == 0 || req->filename_len > APR_PATH_MAX
|| req->argv0_len == 0 || req->argv0_len > APR_PATH_MAX
|| req->uri_len == 0 || req->uri_len > APR_PATH_MAX
|| req->args_len > APR_PATH_MAX) {
return APR_EINVAL;
}
There are three problems:
1) req->env_count is arbitrary limited to ENV_COUNT_MAX (256), a value too
small for some uses
2) If the limit is hit, the error is unhelpful to spot the problem.
3) req->uri_len and req->args_len are limited to a filesystem limit while they
are obtained from an HTTP request, which can be as large as LimitRequestLine
(8190 by default, APR_PATH_MAX is 1024).
Attached patch addresses the three points:
1) We introduce a ScriptEnvSize directive so that the environment entries limit
can be increased by configuration.
2) A helpful arror message is added if environment is too big.
3) req->uri_len and req->args_len are checked against LimitRequestLine
The ScriptEnvSize directive documentation is not yet included, I will write if
the change is considered okay.
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
