Skip to content

harden size calculations, bounds checks, and SHM layout validation - #626

Closed
metsw24-max wants to merge 1 commit into
apache:trunkfrom
metsw24-max:slotmem-hardening-overflow-bounds
Closed

harden size calculations, bounds checks, and SHM layout validation#626
metsw24-max wants to merge 1 commit into
apache:trunkfrom
metsw24-max:slotmem-hardening-overflow-bounds

Conversation

@metsw24-max

Copy link
Copy Markdown

adds overflow-safe helpers for size arithmetic and applies them to all allocation and layout calculations in both slotmem backends

rejects creation when item_size * item_num or derived sizes overflow preventing under-allocation that could lead to out-of-bounds access during slot indexing

replaces direct size expressions with validated basesize, inuse_size, and alloc_size to ensure all memory allocations are correctly bounded

adds checks in slotmem_get and slotmem_put to ensure dest_len and src_len do not exceed the fixed slot size, preventing out-of-bounds reads and writes via memcpy

reorders validation so that slot index bounds are checked before deriving pointers like inuse + id, avoiding invalid pointer computation

adds guards against overflow in pointer arithmetic size * id before computing slot addresses

validates shared memory layout during slotmem_attach by recomputing expected size from descriptor fields and ensuring it does not exceed the actual segment size

prevents use of corrupted or inconsistent shared memory segments that could otherwise lead to invalid memory access

@metsw24-max

Copy link
Copy Markdown
Author

@notroj look into this

@notroj

Copy link
Copy Markdown
Collaborator

Thanks for the PR

notroj added a commit to notroj/httpd that referenced this pull request Aug 7, 2026
* modules/slotmem/mod_slotmem_plain.c,
modules/slotmem/mod_slotmem_shm.c
(slotmem_size_mul, slotmem_size_add): New helper functions for
checked arithmetic on apr_size_t values.
(slotmem_create): Use checked arithmetic for allocation size
calculations to prevent integer overflow.
(slotmem_grab): Add overflow check on size * id multiplication
before pointer arithmetic.
(slotmem_get): Validate dest_len against slot size before access,
move inuse pointer dereference after bounds checks.
(slotmem_put): Validate src_len against slot size before access,
move inuse pointer dereference after bounds checks.
* modules/slotmem/mod_slotmem_shm.c (slotmem_fgrab): Add overflow
check on size * id multiplication before pointer arithmetic.
(slotmem_attach): Validate shared memory segment size against
expected size computed with checked arithmetic. Use basesize
variable for inuse pointer calculation.
Submitted by: metsw24-max <metsw24 gmail.com>
GitHub: closesapache#626
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1936268 13f79535-47bb-0310-9956-ffa450edef68
notroj added a commit to notroj/httpd that referenced this pull request Aug 7, 2026
* modules/slotmem/mod_slotmem_plain.c,
modules/slotmem/mod_slotmem_shm.c
(slotmem_size_mul, slotmem_size_add): New helper functions for
checked arithmetic on apr_size_t values.
(slotmem_create): Use checked arithmetic for allocation size
calculations to prevent integer overflow.
(slotmem_grab): Add overflow check on size * id multiplication
before pointer arithmetic.
(slotmem_get): Validate dest_len against slot size before access,
move inuse pointer dereference after bounds checks.
(slotmem_put): Validate src_len against slot size before access,
move inuse pointer dereference after bounds checks.
* modules/slotmem/mod_slotmem_shm.c (slotmem_fgrab): Add overflow
check on size * id multiplication before pointer arithmetic.
(slotmem_attach): Validate shared memory segment size against
expected size computed with checked arithmetic. Use basesize
variable for inuse pointer calculation.
Submitted by: metsw24-max <metsw24 gmail.com>
GitHub: closesapache#626
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1936268 13f79535-47bb-0310-9956-ffa450edef68
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants

@metsw24-max@notroj