On 1/6/26 12:02 PM, [email protected] wrote: > Author: jorton > Date: Tue Jan 6 11:02:20 2026 > New Revision: 1931148 > > Log: > mod_dav: Fix security issue in unreleased MS-WDV support: > > * modules/dav/main/ms_wdv.c (mswdv_combined_proppatch): > The MS-WDV combined PROPPATCH handler reads a 16-byte hex length > prefix from the request body and uses it directly for memory > allocation without bounds checking. An attacker can specify an > extremely large value to trigger OOM and crash the worker process. > > This patch validates the parsed length against LimitXMLRequestBody > and APR_SIZE_MAX before allocation. > > Reported by: Pavel Kohout, Aisle Research, www.aisle.com > Submitted by: Pavel Kohout, jorton > Github: closes #592 > > Modified: > httpd/httpd/trunk/modules/dav/main/ms_wdv.c > > Modified: httpd/httpd/trunk/modules/dav/main/ms_wdv.c > ============================================================================== > --- httpd/httpd/trunk/modules/dav/main/ms_wdv.c Tue Jan 6 10:59:21 > 2026 (r1931147) > +++ httpd/httpd/trunk/modules/dav/main/ms_wdv.c Tue Jan 6 11:02:20 > 2026 (r1931148) > @@ -6,6 +6,7 @@ > #include "http_protocol.h" > #include "http_request.h" > #include "http_log.h" > +#include "http_core.h" > > #include "mod_dav.h" > > @@ -589,7 +590,7 @@ static dav_error *mswdv_combined_proppat > apr_bucket_brigade *bb; > apr_status_t status; > apr_size_t len = 16; > - apr_off_t proppatch_len; > + apr_off_t proppatch_len, limit; > char proppatch_len_str[16 + 1]; > char *proppatch_data; > > @@ -618,6 +619,17 @@ static dav_error *mswdv_combined_proppat > return dav_new_error(r->pool, HTTP_BAD_REQUEST, 0, status, > "Bad PROPPATCH part length"); > > + /* Validate PROPPATCH length against configured limits */ > + limit = ap_get_limit_xml_body(r); > + if (limit > 0 && proppatch_len > limit) { > + return dav_new_error(r->pool, HTTP_REQUEST_ENTITY_TOO_LARGE, 0, 0, > + "PROPPATCH part length exceeds configured > limit"); > + } > + if (proppatch_len <= 0 || proppatch_len > (apr_off_t)APR_SIZE_MAX) { How can proppatch_len be larger than APR_SIZE_MAX? IMHO the maximum value of proppatch_len being an apr_off_t is 9,223,372,036,854,775,807 APR_SIZE_MAX is the maximum value of apr_size_t which is 18,446,744,073,709,551,615. Or should this guard against cases of 32 bit systems with _FILE_OFFSET_BITS=64 or _LARGEFILE64_SOURCE set where apr_off_t is 64 bit and apr_size_t 32 bit? If yes it is probably worth documenting this in a comment. > + return dav_new_error(r->pool, HTTP_REQUEST_ENTITY_TOO_LARGE, 0, 0, > + "PROPPATCH part length invalid or too large"); > + } > + > apr_brigade_destroy(bb); > > bb = apr_brigade_create(r->pool, r->connection->bucket_alloc); > > Regards Rüdiger
