Limit length of lines in .htaccess to 8K again, to reduce DoS potential. (4c136c67) · Commits · CYBER - Cyber Security / TS 103 523 MSP / TLMSP / TLMSP Apache Httpd

docs/manual/configuring.xml

+5 −0

Changes for docs/manual/configuring.xml: 5 added lines, 0 removed lines.
Original line number	Diff line number	Diff line
		@@ -96,6 +96,11 @@ Server.</p>
		module="mod_env">SetEnv</directive>, take effect too late to be used for
		expansions in the configuration file.</p>

		<p>The maximum length of a line in normal configuration files, after
		variable substitution and joining any continued lines, is approximately
		16 MiB. In <a href="configuring.xml#htaccess">.htaccess files</a>, the
		maximum length is 8190 characters.</p>

		<p>You can check your configuration files for syntax errors
		without starting the server by using <code>apachectl
		configtest</code> or the <code>-t</code> command line

include/http_config.h

+6 −0

Changes for include/http_config.h: 6 added lines, 0 removed lines.
Original line number	Diff line number	Diff line
		@@ -818,6 +818,8 @@ AP_DECLARE(const char ) ap_pcfg_strerror(apr_pool_t p, ap_configfile_t *cfp,
		* @param cmd The cmd_parms to pass to the directives inside the container
		* @param directive The directive name to read until
		* @return Error string on failure, NULL on success
		* @note If cmd->pool == cmd->temp_pool, ap_soak_end_container() will assume
		* .htaccess context and use a lower maximum line length.
		*/
		AP_DECLARE(const char ) ap_soak_end_container(cmd_parms cmd, char *directive);

		@@ -831,6 +833,8 @@ AP_DECLARE(const char ) ap_soak_end_container(cmd_parms cmd, char *directive);
		* @param curr_parent The current parent node
		* @param orig_directive The directive to read until hit.
		* @return Error string on failure, NULL on success
		* @note If p == temp_pool, ap_build_cont_config() will assume .htaccess
		* context and use a lower maximum line length.
		*/
		AP_DECLARE(const char ) ap_build_cont_config(apr_pool_t p,
		apr_pool_t *temp_pool,
		@@ -846,6 +850,8 @@ AP_DECLARE(const char ) ap_build_cont_config(apr_pool_t p,
		* @param temp_pool The temporary pool
		* @param conftree Place to store the root node of the config tree
		* @return Error string on erro, NULL otherwise
		* @note If conf_pool == temp_pool, ap_build_config() will assume .htaccess
		* context and use a lower maximum line length.
		*/
		AP_DECLARE(const char ) ap_build_config(cmd_parms parms,
		apr_pool_t *conf_pool,

include/util_varbuf.h

+1 −3

Changes for include/util_varbuf.h: 1 added line, 3 removed lines.
Original line number	Diff line number	Diff line
		@@ -151,10 +151,8 @@ AP_DECLARE(apr_status_t) ap_varbuf_regsub(struct ap_varbuf *vb,
		/** Read a line from an ap_configfile_t into an ap_varbuf.
		* @param vb pointer to the ap_varbuf struct
		* @param cfg pointer to the ap_configfile_t
		* @param max_len (soft) limit for the size of the buffer
		* @param max_len maximum line length, including leading/trailing whitespace
		* @return see ap_cfg_getline()
		* @note The buffer will not be grown once it has reached at least max_len
		* bytes. This means that the returned line can be longer than max_len.
		* @note vb->strlen will be set to the length of the line
		*/
		AP_DECLARE(apr_status_t) ap_varbuf_cfg_getline(struct ap_varbuf *vb,

server/config.c

+12 −3

Changes for server/config.c: 12 added lines, 3 removed lines.
Original line number	Diff line number	Diff line
		@@ -1202,11 +1202,14 @@ AP_DECLARE(const char ) ap_build_cont_config(apr_pool_t p,
		ap_directive_t *sub_tree = NULL;
		apr_status_t rc;
		struct ap_varbuf vb;
		apr_size_t max_len = VARBUF_MAX_LEN;
		if (p == temp_pool)
		max_len = HUGE_STRING_LEN; /* lower limit for .htaccess */

		bracket = apr_pstrcat(temp_pool, orig_directive + 1, ">", NULL);
		ap_varbuf_init(temp_pool, &vb, VARBUF_INIT_LEN);

		while ((rc = ap_varbuf_cfg_getline(&vb, parms->config_file, VARBUF_MAX_LEN))
		while ((rc = ap_varbuf_cfg_getline(&vb, parms->config_file, max_len))
		== APR_SUCCESS) {
		if (!memcmp(vb.buf, "</", 2)
		&& (strcasecmp(vb.buf + 2, bracket) == 0)
		@@ -1324,6 +1327,9 @@ AP_DECLARE(const char ) ap_build_config(cmd_parms parms,
		ap_directive_t **last_ptr = NULL;
		apr_status_t rc;
		struct ap_varbuf vb;
		apr_size_t max_len = VARBUF_MAX_LEN;
		if (p == temp_pool)
		max_len = HUGE_STRING_LEN; /* lower limit for .htaccess */

		ap_varbuf_init(temp_pool, &vb, VARBUF_INIT_LEN);

		@@ -1349,7 +1355,7 @@ AP_DECLARE(const char ) ap_build_config(cmd_parms parms,
		}
		}

		while ((rc = ap_varbuf_cfg_getline(&vb, parms->config_file, VARBUF_MAX_LEN))
		while ((rc = ap_varbuf_cfg_getline(&vb, parms->config_file, max_len))
		== APR_SUCCESS) {
		errmsg = ap_build_config_sub(p, temp_pool, vb.buf, parms,
		&current, &curr_parent, conftree);
		@@ -1540,10 +1546,13 @@ AP_DECLARE(const char ) ap_soak_end_container(cmd_parms cmd, char *directive)
		const char *args;
		char *cmd_name;
		apr_status_t rc;
		apr_size_t max_len = VARBUF_MAX_LEN;
		if (cmd->pool == cmd->temp_pool)
		max_len = HUGE_STRING_LEN; /* lower limit for .htaccess */

		ap_varbuf_init(cmd->temp_pool, &vb, VARBUF_INIT_LEN);

		while((rc = ap_varbuf_cfg_getline(&vb, cmd->config_file, VARBUF_MAX_LEN))
		while((rc = ap_varbuf_cfg_getline(&vb, cmd->config_file, max_len))
		== APR_SUCCESS) {
		#if RESOLVE_ENV_PER_TOKEN
		args = vb.buf;

server/util.c

+2 −0

Changes for server/util.c: 2 added lines, 0 removed lines.
Original line number	Diff line number	Diff line
		@@ -1112,6 +1112,8 @@ AP_DECLARE(apr_status_t) ap_varbuf_cfg_getline(struct ap_varbuf *vb,
		ap_varbuf_grow(vb, new_len);
		--cfp->line_number;
		}
		if (vb->strlen > max_len)
		return APR_ENOSPC;
		if (rc == APR_SUCCESS)
		vb->strlen = cfg_trim_line(vb->buf);
		return rc;