From 48100751013bf08880bbe0c97cc99bae55b4d952 Mon Sep 17 00:00:00 2001 From: Eric Covener Date: Wed, 14 Dec 2016 22:27:25 +0000 Subject: Merge r1774288 from trunk: short-circuit some kinds of looping in RewriteRule. PR60478 Submitted By: Jeff Wheelouse Committed By: covener git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1774352 13f79535-47bb-0310-9956-ffa450edef68 --- modules/mappers/mod_rewrite.c | 11 +++++++++++ 1 file changed, 11 insertions(+) (limited to 'modules/mappers') diff --git a/modules/mappers/mod_rewrite.c b/modules/mappers/mod_rewrite.c index 56957c904a..dcf7988ed0 100644 --- a/modules/mappers/mod_rewrite.c +++ b/modules/mappers/mod_rewrite.c @@ -4295,6 +4295,17 @@ static int apply_rewrite_list(request_rec *r, apr_array_header_t *rewriterules, rc = apply_rewrite_rule(p, ctx); if (rc) { + + /* Catch looping rules with pathinfo growing unbounded */ + if ( strlen( r->filename ) > 2*r->server->limit_req_line ) { + ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, + "RewriteRule '%s' and URI '%s' " + "exceeded maximum length (%d)", + p->pattern, r->uri, 2*r->server->limit_req_line ); + r->status = HTTP_INTERNAL_SERVER_ERROR; + return ACTION_STATUS; + } + /* Regardless of what we do next, we've found a match. Check to see * if any of the request header fields were involved, and add them * to the Vary field of the response. -- cgit v1.2.1