From 3e7df0ab3c53cf440b078424db8978f2f89caf09 Mon Sep 17 00:00:00 2001 From: Sabith Saheb Date: Tue, 21 Jul 2026 14:03:34 +0530 Subject: [PATCH] Fix allocation size overflow guards in canonenc and make_full_path ap_proxy_canonenc_ex(): len is an int, so 3 * len + 1 is computed in int arithmetic and overflows for len > INT_MAX / 3. Assert that len is non-negative and within (INT_MAX - 1) / 3 before allocating. ap_make_full_path(): assert that len1 + len2 + 3 cannot wrap, bounding len2 first so the limit for len1 itself cannot wrap. --- modules/proxy/proxy_util.c | 1 + server/util.c | 1 + 2 files changed, 2 insertions(+) diff --git a/modules/proxy/proxy_util.c b/modules/proxy/proxy_util.c index a57c35ce0d2..9214d9a4fe7 100644 --- a/modules/proxy/proxy_util.c +++ b/modules/proxy/proxy_util.c @@ -262,6 +262,7 @@ PROXY_DECLARE(char *)ap_proxy_canonenc_ex(apr_pool_t *p, const char *x, int len, reserved = ""; } + ap_assert(len >= 0 && len <= (INT_MAX - 1) / 3); y = apr_palloc(p, 3 * len + 1); for (i = 0, j = 0; i < len; i++, j++) { diff --git a/server/util.c b/server/util.c index d1d06fc15b4..d2810a2cac2 100644 --- a/server/util.c +++ b/server/util.c @@ -2376,6 +2376,7 @@ AP_DECLARE(char *) ap_make_full_path(apr_pool_t *a, const char *src1, /* allocate +3 for '/' delimiter, trailing NULL and overallocate * one extra byte to allow the caller to add a trailing '/' */ + ap_assert(len2 <= APR_SIZE_MAX - 3 && len1 <= APR_SIZE_MAX - 3 - len2); path = (char *)apr_palloc(a, len1 + len2 + 3); if (len1 == 0) { *path = '/';