https://bz.apache.org/bugzilla/show_bug.cgi?id=65788
--- Comment #1 from abernal <[email protected]> --- Confirmed: dav_get_timeout_string() (modules/dav/main/util.c) parses "Timeout: Second-<N>" with atol(), which has no overflow detection; a long enough digit string overflows it (saturating to LONG_MAX on this platform), and "now + expires" then overflows time_t too, so the lock is silently stored with an already-expired timeout instead of the large-but-finite one requested. Reproduced against a real build: "Timeout: Second-99999999999999999999999999999999" got back "Second-0" before the fix, "Second-4294967295" (the RFC 4918 TimeOut maximum) after it. Fix and a regression test are available as a pull request: https://github.com/apache/httpd/pull/920 -- You are receiving this mail because: You are the assignee for the bug. --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
