Skip to content

Commit 3f7bf11

Browse files
fzipifzipi
committed
fix: resolve signed/unsigned mismatches and incomplete size_t propagation
Keep masking offset as signed int in msc_logging.c to prevent negative pos from disabling sanitization via unsigned comparison. Propagate size_t to loop indices, function signatures, and format specifiers. Revert size_t where downstream consumers are all int.
1 parent 86f4b3a commit 3f7bf11

6 files changed

Lines changed: 13 additions & 13 deletions

File tree

‎apache2/msc_crypt.c‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -700,7 +700,7 @@ int do_hash_method(modsec_rec *msr, char *link, int type) {
700700
int hash_response_body_links(modsec_rec *msr) {
701701
int lsize = 0, fsize = 0, lcount = 0, fcount = 0, i;
702702
int isize = 0, icount = 0, frsize = 0, frcount = 0;
703-
size_t bytes = 0;
703+
int bytes = 0;
704704
xmlXPathContextPtr xpathCtx = NULL;
705705
xmlXPathObjectPtr xpathObj = NULL;
706706
xmlChar *content_option = NULL;

‎apache2/msc_logging.c‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -334,7 +334,7 @@ static void sanitize_request_line(modsec_rec *msr) {
334334
arg_max = 1;
335335
while((*pat != '\0')&&(j--)) {
336336
if(arg_max > mparm->pad_2) {
337-
size_t off = (strlen(mparm->value) - arg_max);
337+
int off = (int)strlen(mparm->value) - arg_max;
338338
int pos = (mparm->pad_1-1);
339339
if(off > pos) {
340340
*pat = '*';
@@ -829,7 +829,7 @@ void sec_audit_logger_json(modsec_rec *msr) {
829829
arg_max = 1;
830830
while((*pat != '\0')&&(j--)) {
831831
if(arg_max > mparm->pad_2) {
832-
size_t off = strlen(mparm->value) - arg_max;
832+
int off = (int)strlen(mparm->value) - arg_max;
833833
int pos = mparm->pad_1-1;
834834
if(off > pos) {
835835
*pat = '*';
@@ -1086,7 +1086,7 @@ void sec_audit_logger_json(modsec_rec *msr) {
10861086
arg_max = 1;
10871087
while((*pat != '\0')&&(j--)) {
10881088
if(arg_max > mparm->pad_2) {
1089-
size_t off = strlen(mparm->value) - arg_max;
1089+
int off = (int)strlen(mparm->value) - arg_max;
10901090
int pos = mparm->pad_1-1;
10911091
if(off > pos) {
10921092
*pat = '*';
@@ -1686,7 +1686,7 @@ void sec_audit_logger_native(modsec_rec *msr) {
16861686
arg_max = 1;
16871687
while((*pat != '\0')&&(j--)) {
16881688
if(arg_max > mparm->pad_2) {
1689-
size_t off = strlen(mparm->value) - arg_max;
1689+
int off = (int)strlen(mparm->value) - arg_max;
16901690
int pos = mparm->pad_1-1;
16911691
if(off > pos) {
16921692
*pat = '*';
@@ -1934,7 +1934,7 @@ void sec_audit_logger_native(modsec_rec *msr) {
19341934
arg_max = 1;
19351935
while((*pat != '\0')&&(j--)) {
19361936
if(arg_max > mparm->pad_2) {
1937-
size_t off = strlen(mparm->value) - arg_max;
1937+
int off = (int)strlen(mparm->value) - arg_max;
19381938
int pos = mparm->pad_1-1;
19391939
if(off > pos) {
19401940
*pat = '*';

‎apache2/msc_multipart.c‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -22,7 +22,7 @@
2222

2323
void validate_quotes(modsec_rec *msr, char *data, char quote) {
2424
assert(msr != NULL);
25-
int i;
25+
size_t i;
2626
size_t len;
2727

2828
if(msr->mpd == NULL)
@@ -43,7 +43,7 @@ void validate_quotes(modsec_rec *msr, char *data, char quote) {
4343

4444
if(data[i] == '\'') {
4545
if (msr->txcfg->debuglog_level >= 9) {
46-
msr_log(msr, 9, "Multipart: Invalid quoting detected: %s length %d bytes",
46+
msr_log(msr, 9, "Multipart: Invalid quoting detected: %s length %zu bytes",
4747
log_escape_nq(msr->mp, data), len);
4848
}
4949
msr->mpd->flag_invalid_quoting = 1;

‎apache2/msc_util.c‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -277,9 +277,9 @@ unsigned char is_netmask_v6(char *ip_strv6) {
277277
char *parse_pm_content(const char *op_parm, size_t op_len, msre_rule *rule, char **error_msg) {
278278
char *parm = NULL;
279279
char *content = NULL;
280-
unsigned short int offset = 0;
280+
size_t offset = 0;
281281
char converted = 0;
282-
int i, x;
282+
size_t i, x;
283283
unsigned char bin = 0, esc = 0, bin_offset = 0;
284284
unsigned char c = 0;
285285
unsigned char bin_parm[3] = { 0 };

‎apache2/re_operators.c‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1362,7 +1362,7 @@ static int msre_op_pmFromFile_param_init(msre_rule *rule, char **error_msg) {
13621362
char *end = NULL;
13631363
const char *rulefile_path;
13641364
char *processed = NULL;
1365-
unsigned short int op_len;
1365+
size_t op_len;
13661366
apr_status_t rc;
13671367
apr_file_t *fd = NULL;
13681368
ACMP *p;
@@ -1703,7 +1703,7 @@ static const char *gsb_reduce_char(apr_pool_t *pool, const char *domain) {
17031703
* \retval 1 On Match
17041704
* \retval 0 On No Match
17051705
*/
1706-
static int verify_gsb(gsb_db *gsb, modsec_rec *msr, const char *match, unsigned int match_length) {
1706+
static int verify_gsb(gsb_db *gsb, modsec_rec *msr, const char *match, size_t match_length) {
17071707
assert(gsb != NULL);
17081708
assert(msr != NULL);
17091709
assert(match != NULL);

‎apache2/re_variables.c‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2484,7 +2484,7 @@ static int var_full_request_generate(modsec_rec *msr, msre_var *var,
24842484
char *full_request = NULL;
24852485
int full_request_length = 0;
24862486
int headers_length = 0;
2487-
size_t request_line_length = 0;
2487+
int request_line_length = 0;
24882488

24892489
arr = apr_table_elts(msr->request_headers);
24902490
headers_length = msc_headers_to_buffer(arr, NULL, 0);

0 commit comments

Comments
 (0)