From 5114735bc82da83680294fc9aea0adf43d6a66cf Mon Sep 17 00:00:00 2001 From: arshiya tabasum Date: Mon, 24 Aug 2026 13:12:47 +0530 Subject: [PATCH] mod_proxy_http2: reserve NUL when rewriting a backend Link header uri --- changes-entries/h2-proxy-link-map-off-by-one.txt | 3 +++ modules/http2/h2_proxy_util.c | 2 +- 2 files changed, 4 insertions(+), 1 deletion(-) create mode 100644 changes-entries/h2-proxy-link-map-off-by-one.txt diff --git a/changes-entries/h2-proxy-link-map-off-by-one.txt b/changes-entries/h2-proxy-link-map-off-by-one.txt new file mode 100644 index 00000000000..15a61e68676 --- /dev/null +++ b/changes-entries/h2-proxy-link-map-off-by-one.txt @@ -0,0 +1,3 @@ + *) mod_proxy_http2: Reserve room for the terminating NUL when rewriting a + backend Link response header, fixing a one-byte stack overflow reachable + with a crafted Link header. [arshiya tabasum] diff --git a/modules/http2/h2_proxy_util.c b/modules/http2/h2_proxy_util.c index ea9da14ee89..b7a4c509107 100644 --- a/modules/http2/h2_proxy_util.c +++ b/modules/http2/h2_proxy_util.c @@ -976,7 +976,7 @@ static void map_link(link_ctx *ctx) * to work, we need to use the proxy uri */ int path_start = ctx->link_start + ctx->rbu_len; link_len -= ctx->rbu_len; - need_len = ctx->psu_len + link_len; + need_len = ctx->psu_len + link_len + 1; if (need_len > sizeof(buffer)) goto out; memcpy(buffer, ctx->p_server_uri, ctx->psu_len);