Re: CVE-2011-3607, int overflow ap_pregsub()

2011-12-22 Thread Stefan Fritsch
On Wed, 21 Dec 2011, Greg Ames wrote: On Tue, Dec 20, 2011 at 4:26 AM, William A. Rowe Jr. wrote: We should come to a conclusion on this. How about this for 2.2.x ? --- server/util.c (revision 1179624) +++ server/util.c (working copy) @@ -82,6 +82,8 @@ #define IS_SLASH(s) (s ==

Re: CVE-2011-3607, int overflow ap_pregsub()

2011-12-21 Thread Rüdiger Plüm
Am 21.12.2011 20:08, schrieb Greg Ames: On Tue, Dec 20, 2011 at 4:26 AM, William A. Rowe Jr. wrote: We should come to a conclusion on this. How about this for 2.2.x ? --- server/util.c (revision 1179624) +++ server/util.c (working copy) @@ -82,6 +82,8 @@ #define IS_SLASH(s)

Re: CVE-2011-3607, int overflow ap_pregsub()

2011-12-21 Thread Guenter Knauf
Am 21.12.2011 23:28, schrieb Guenter Knauf: Am 21.12.2011 20:08, schrieb Greg Ames: On Tue, Dec 20, 2011 at 4:26 AM, William A. Rowe Jr. wrote: We should come to a conclusion on this. How about this for 2.2.x ? --- server/util.c (revision 1179624) +++ server/util.c (working copy) @@ -82,6 +

Re: CVE-2011-3607, int overflow ap_pregsub()

2011-12-21 Thread Guenter Knauf
Am 21.12.2011 20:08, schrieb Greg Ames: On Tue, Dec 20, 2011 at 4:26 AM, William A. Rowe Jr. wrote: We should come to a conclusion on this. How about this for 2.2.x ? --- server/util.c (revision 1179624) +++ server/util.c (working copy) @@ -82,6 +82,8 @@ #define IS_SLASH(s) (s

Re: CVE-2011-3607, int overflow ap_pregsub()

2011-12-21 Thread Greg Ames
On Tue, Dec 20, 2011 at 4:26 AM, William A. Rowe Jr. wrote: > We should come to a conclusion on this. How about this for 2.2.x ? --- server/util.c (revision 1179624) +++ server/util.c (working copy) @@ -82,6 +82,8 @@ #define IS_SLASH(s) (s == '/') #endif +/* same as APR_SIZE_MAX w

Re: CVE-2011-3607, int overflow ap_pregsub()

2011-12-20 Thread William A. Rowe Jr.
We should come to a conclusion on this. On 11/15/2011 8:22 AM, "Plüm, Rüdiger, VF-Group" wrote: > The patch is fine on trunk because the affected code is not within > > AP_DECLARE(char *) ap_pregsub(...) > > but within > > static apr_status_t regsub_core(apr_pool_t *p, char **result, >

RE: CVE-2011-3607, int overflow ap_pregsub()

2011-11-15 Thread Plüm, Rüdiger, VF-Group
The patch is fine on trunk because the affected code is not within AP_DECLARE(char *) ap_pregsub(...) but within static apr_status_t regsub_core(apr_pool_t *p, char **result, struct ap_varbuf *vb, const char *input, const char *s