Uh oh!
There was an error while loading. Please reload this page.
harden size calculations, bounds checks, and SHM layout validation - #626
Closed
metsw24-max wants to merge 1 commit into
Closed
harden size calculations, bounds checks, and SHM layout validation#626metsw24-max wants to merge 1 commit into
metsw24-max wants to merge 1 commit into
Conversation
metsw24-max
commented
Apr 10, 2026
Author
@notroj look into this |
notroj
commented
Jul 17, 2026
Collaborator
Thanks for the PR |
notroj added a commit
to notroj/httpd
that referenced
this pull request
Aug 7, 2026
* modules/slotmem/mod_slotmem_plain.c, modules/slotmem/mod_slotmem_shm.c (slotmem_size_mul, slotmem_size_add): New helper functions for checked arithmetic on apr_size_t values. (slotmem_create): Use checked arithmetic for allocation size calculations to prevent integer overflow. (slotmem_grab): Add overflow check on size * id multiplication before pointer arithmetic. (slotmem_get): Validate dest_len against slot size before access, move inuse pointer dereference after bounds checks. (slotmem_put): Validate src_len against slot size before access, move inuse pointer dereference after bounds checks. * modules/slotmem/mod_slotmem_shm.c (slotmem_fgrab): Add overflow check on size * id multiplication before pointer arithmetic. (slotmem_attach): Validate shared memory segment size against expected size computed with checked arithmetic. Use basesize variable for inuse pointer calculation. Submitted by: metsw24-max <metsw24 gmail.com> GitHub: closesapache#626 git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1936268 13f79535-47bb-0310-9956-ffa450edef68
notroj added a commit
to notroj/httpd
that referenced
this pull request
Aug 7, 2026
* modules/slotmem/mod_slotmem_plain.c, modules/slotmem/mod_slotmem_shm.c (slotmem_size_mul, slotmem_size_add): New helper functions for checked arithmetic on apr_size_t values. (slotmem_create): Use checked arithmetic for allocation size calculations to prevent integer overflow. (slotmem_grab): Add overflow check on size * id multiplication before pointer arithmetic. (slotmem_get): Validate dest_len against slot size before access, move inuse pointer dereference after bounds checks. (slotmem_put): Validate src_len against slot size before access, move inuse pointer dereference after bounds checks. * modules/slotmem/mod_slotmem_shm.c (slotmem_fgrab): Add overflow check on size * id multiplication before pointer arithmetic. (slotmem_attach): Validate shared memory segment size against expected size computed with checked arithmetic. Use basesize variable for inuse pointer calculation. Submitted by: metsw24-max <metsw24 gmail.com> GitHub: closesapache#626 git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1936268 13f79535-47bb-0310-9956-ffa450edef68
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
adds overflow-safe helpers for size arithmetic and applies them to all allocation and layout calculations in both slotmem backends
rejects creation when
item_size * item_numor derived sizes overflow preventing under-allocation that could lead to out-of-bounds access during slot indexingreplaces direct size expressions with validated
basesize,inuse_size, andalloc_sizeto ensure all memory allocations are correctly boundedadds checks in
slotmem_getandslotmem_putto ensuredest_lenandsrc_lendo not exceed the fixed slot size, preventing out-of-bounds reads and writes via memcpyreorders validation so that slot index bounds are checked before deriving pointers like
inuse + id, avoiding invalid pointer computationadds guards against overflow in pointer arithmetic
size * idbefore computing slot addressesvalidates shared memory layout during
slotmem_attachby recomputing expected size from descriptor fields and ensuring it does not exceed the actual segment sizeprevents use of corrupted or inconsistent shared memory segments that could otherwise lead to invalid memory access