This is an automated email from the ASF dual-hosted git repository.
markt-asf pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/tomcat-connectors.git
The following commit(s) were added to refs/heads/main by this push:
new 640927009 Better length checks when processing response header values.
640927009 is described below
commit 6409270095d9faa3b22ae37693dde77ac89cf907
Author: Mark Thomas <[email protected]>
AuthorDate: Mon Sep 28 15:08:03 2026 +0100
Better length checks when processing response header values.
---
native/common/jk_msg_buff.c | 4 ++--
xdocs/miscellaneous/changelog.xml | 5 ++++-
2 files changed, 6 insertions(+), 3 deletions(-)
diff --git a/native/common/jk_msg_buff.c b/native/common/jk_msg_buff.c
index 731eb7005..7115eca0f 100644
--- a/native/common/jk_msg_buff.c
+++ b/native/common/jk_msg_buff.c
@@ -285,7 +285,7 @@ char *jk_b_get_string(jk_msg_buf_t *msg)
unsigned short size = jk_b_get_int(msg);
int start = msg->pos;
- if ((size == 0xFFFF) || (size + start > msg->maxlen)) {
+ if ((size == 0xFFFF) || (size + start >= msg->len) || msg->buf[start +
size] != '\0') {
/* Error of overflow in AJP packet.
* The complete message is probably invalid.
*/
@@ -302,7 +302,7 @@ int jk_b_get_bytes(jk_msg_buf_t *msg, unsigned char *buf,
int len)
{
int start = msg->pos;
- if ((len < 0) || (len + start > msg->maxlen)) {
+ if ((len < 0) || (len + start > msg->len)) {
return (-1);
}
diff --git a/xdocs/miscellaneous/changelog.xml
b/xdocs/miscellaneous/changelog.xml
index 4253b3b13..e648f0996 100644
--- a/xdocs/miscellaneous/changelog.xml
+++ b/xdocs/miscellaneous/changelog.xml
@@ -117,8 +117,11 @@
Constify static arrays of string constants. (rjung)
</update>
<add>
- A a lower bounds check for common response header codes. (markt)
+ Add a lower bounds check for common response header codes. (markt)
</add>
+ <fix>
+ Better length checks when processing response header values. (markt)
+ </fix>
</changelog>
</subsection>
<subsection name="Docs">
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
