From 159d7a586f415ee13d3a544b9faee38a2dc6e1c6 Mon Sep 17 00:00:00 2001 From: arshiya tabasum Date: Mon, 17 Aug 2026 18:32:07 +0530 Subject: [PATCH] mod_lua: fix stack write past apr_size_t in r:parsebody --- changes-entries/lua-parsebody-off-t.txt | 4 ++++ modules/lua/lua_request.c | 4 +++- 2 files changed, 7 insertions(+), 1 deletion(-) create mode 100644 changes-entries/lua-parsebody-off-t.txt diff --git a/changes-entries/lua-parsebody-off-t.txt b/changes-entries/lua-parsebody-off-t.txt new file mode 100644 index 00000000000..26dd03e6457 --- /dev/null +++ b/changes-entries/lua-parsebody-off-t.txt @@ -0,0 +1,4 @@ + *) mod_lua: Fix a stack write past a 4-byte object in r:parsebody() where + the body length was read through an apr_off_t* aliased onto an apr_size_t, + corrupting adjacent stack on builds with sizeof(apr_off_t) > sizeof(apr_size_t) + (32-bit large-file). [arshiya tabasum] diff --git a/modules/lua/lua_request.c b/modules/lua/lua_request.c index 587b690c6fa..6843679006b 100644 --- a/modules/lua/lua_request.c +++ b/modules/lua/lua_request.c @@ -399,9 +399,11 @@ static int req_parsebody(lua_State *L) int i; size_t vlen = 0; size_t len = 0; - if (lua_read_body(r, &data, (apr_off_t*) &size, max_post_size) != OK) { + apr_off_t body_len = 0; + if (lua_read_body(r, &data, &body_len, max_post_size) != OK) { return 2; } + size = (apr_size_t) body_len; len = strlen(multipart); i = 0; for