Rooba
/
oss-fuzz
mirror of https://github.com/google/oss-fuzz.git
1
1
Fork 0
Code Issues Packages Projects Releases Wiki Activity

apache-httpd: fix patch for hitting assert. (#6320)

This commit is contained in:
DavidKorczynski 2021-08-26 21:03:14 +01:00 committed by GitHub
parent 1fdbe5ebf7
commit 5fa56976f4
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 16 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

19
projects/apache-httpd/patches.diff
View File

@ -1,5 +1,5 @@
diff --git a/server/apreq_parser_header.c b/server/apreq_parser_header.c diff --git a/server/apreq_parser_header.c b/server/apreq_parser_header.c
index 19588befd8..d359d7f4ea 100644 index 19588be..ede2acf 100644
--- a/server/apreq_parser_header.c --- a/server/apreq_parser_header.c
+++ b/server/apreq_parser_header.c +++ b/server/apreq_parser_header.c
@@ -89,6 +89,8 @@ static apr_status_t split_header_line(apreq_param_t **p, @@ -89,6 +89,8 @@ static apr_status_t split_header_line(apreq_param_t **p,
@ -11,7 +11,7 @@ index 19588befd8..d359d7f4ea 100644
assert(nlen >= len); assert(nlen >= len);
end->iov_len = len; end->iov_len = len;
nlen -= len; nlen -= len;
@@ -103,6 +105,8 @@ static apr_status_t split_header_line(apreq_param_t **p, @@ -103,12 +105,15 @@ static apr_status_t split_header_line(apreq_param_t **p,
if (s != APR_SUCCESS) if (s != APR_SUCCESS)
return s; return s;
@ -20,7 +20,14 @@ index 19588befd8..d359d7f4ea 100644
assert(glen >= dlen); assert(glen >= dlen);
glen -= dlen; glen -= dlen;
e = APR_BUCKET_NEXT(e); e = APR_BUCKET_NEXT(e);
@@ -119,6 +123,7 @@ static apr_status_t split_header_line(apreq_param_t **p, }
/* copy value */
+ if (!(vlen > 0)) return APR_EBADARG;
assert(vlen > 0);
dest = v->data;
while (vlen > 0) {
@@ -119,11 +124,13 @@ static apr_status_t split_header_line(apreq_param_t **p,
memcpy(dest, data, dlen); memcpy(dest, data, dlen);
dest += dlen; dest += dlen;
@ -28,3 +35,9 @@ index 19588befd8..d359d7f4ea 100644
assert(vlen >= dlen); assert(vlen >= dlen);
vlen -= dlen; vlen -= dlen;
e = APR_BUCKET_NEXT(e); e = APR_BUCKET_NEXT(e);
}
+ if (!(dest[-1] == '\n')) return APR_EBADARG;
assert(dest[-1] == '\n');
if (dest[-2] == '\r')