Skip to content

core: Accept a b/k/m suffix in size-valued directive parameters - #851

Open
notroj wants to merge 2 commits into
apache:trunkfrom
notroj:size-suffix
Open

notroj wants to merge 2 commits into
apache:trunkfrom
notroj:size-suffix

Conversation

@notroj

@notroj notroj commented Oct 15, 2026

Copy link
Copy Markdown
Collaborator

ap_size_parameter_parse() now accepts an optional case-insensitive b, k or m suffix (bytes, ×1024, ×1024×1024) after the number, rejecting overflow with APR_ERANGE. Size-valued directives using it, such as LimitRequestBody, ScriptLogLength, ScriptLogBuffer, DavQuota, BufferSize and AuthFormSize, thereby take the same suffixes AuthDigestShmemSize already did.

A second commit converts mod_auth_digest's set_shmem_size() to the shared parser. Parsing is strict: anything after the suffix is rejected, including trailing whitespace (only reachable via a quoted argument), which set_shmem_size() previously tolerated.

Unit tests added in test/unit/util.c.

🤖 Generated with Claude Code

@arturobernalg

Copy link
Copy Markdown
Member

I think the overflow checks need to use the range of apr_off_t, rather than APR_INT64_{MIN,MAX}. On a platform with 32-bit apr_off_t, e.g. 2097152k passes the current check and then overflow in parsed *= 1024. The "4G" success test has the same assumption.
Also, this will want #848 (or equivalent) before merge, otherwise the new no-conversion tests still differ on musl/FreeBSD.

@notroj

notroj commented Oct 16, 2026

Copy link
Copy Markdown
Collaborator Author

I think the overflow checks need to use the range of apr_off_t, rather than APR_INT64_{MIN,MAX}. On a platform with 32-bit apr_off_t, e.g. 2097152k passes the current check and then overflow in parsed *= 1024. The "4G" success test has the same assumption. Also, this will want #848 (or equivalent) before merge, otherwise the new no-conversion tests still differ on musl/FreeBSD.

Makes sense, thanks for the review! Will do

notroj and others added 2 commits October 17, 2026 21:31
* server/util.c (ap_size_parameter_parse): Allow an optional
  case-insensitive 'b', 'k', 'm' or 'g' suffix, bounding the
  multiplication by the range of apr_off_t.

* include/httpd.h: Update doxygen accordingly.

* modules/filters/mod_substitute.c (set_max_line_length): Use
  ap_size_parameter_parse().

* test/unit/util.c (size_parameter_parse_handles_suffixes): New test.

* test/modules/core/test_012_config_off_t.py: Update for suffix
  support.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
  ap_size_parameter_parse().

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants