Index: httpd-2.2.34/changes-entries/AP_MAX_LIMIT_XML_BODY.diff
===================================================================
--- /dev/null
+++ httpd-2.2.34/changes-entries/AP_MAX_LIMIT_XML_BODY.diff
@@ -0,0 +1,2 @@
+  *) core: Make sure and check that LimitXMLRequestBody fits in system memory.
+     [Ruediger Pluem, Yann Ylavic]
\ No newline at end of file
Index: httpd-2.2.34/server/core.c
===================================================================
--- httpd-2.2.34.orig/server/core.c
+++ httpd-2.2.34/server/core.c
@@ -58,6 +58,8 @@
 /* LimitXMLRequestBody handling */
 #define AP_LIMIT_UNSET                  ((long) -1)
 #define AP_DEFAULT_LIMIT_XML_BODY       ((size_t)1000000)
+/* Hard limit for ap_escape_html2() */
+#define AP_MAX_LIMIT_XML_BODY           ((size_t)(APR_SIZE_MAX / 6 - 1))
 
 #define AP_MIN_SENDFILE_BYTES           (256)
 
@@ -3020,6 +3022,11 @@ static const char *set_limit_xml_req_bod
     if (conf->limit_xml_body < 0)
         return "LimitXMLRequestBody requires a non-negative integer.";
 
+    /* zero is AP_MAX_LIMIT_XML_BODY (implicitly) */
+    if ((apr_size_t)conf->limit_xml_body > AP_MAX_LIMIT_XML_BODY)
+        return apr_psprintf(cmd->pool, "LimitXMLRequestBody must not exceed "
+                            "%" APR_SIZE_T_FMT, AP_MAX_LIMIT_XML_BODY);
+
     return NULL;
 }
 
@@ -3055,6 +3062,8 @@ AP_DECLARE(size_t) ap_get_limit_xml_body
     conf = ap_get_module_config(r->per_dir_config, &core_module);
     if (conf->limit_xml_body == AP_LIMIT_UNSET)
         return AP_DEFAULT_LIMIT_XML_BODY;
+    if (conf->limit_xml_body == 0)
+        return AP_MAX_LIMIT_XML_BODY;
 
     return (size_t)conf->limit_xml_body;
 }
Index: httpd-2.2.34/server/util.c
===================================================================
--- httpd-2.2.34.orig/server/util.c
+++ httpd-2.2.34/server/util.c
@@ -1829,11 +1829,14 @@ AP_DECLARE(char *) ap_os_escape_path(apr
 
 AP_DECLARE(char *) ap_escape_html2(apr_pool_t *p, const char *s, int toasc)
 {
-    int i, j;
+    apr_size_t i, j;
     char *x;
 
     /* first, count the number of extra characters */
-    for (i = 0, j = 0; s[i] != '\0'; i++)
+    for (i = 0, j = 0; s[i] != '\0'; i++) {
+        if (i + j > APR_SIZE_MAX - 6) {
+            abort();
+        }
         if (s[i] == '<' || s[i] == '>')
             j += 3;
         else if (s[i] == '&')
@@ -1842,6 +1845,7 @@ AP_DECLARE(char *) ap_escape_html2(apr_p
             j += 5;
         else if (toasc && !apr_isascii(s[i]))
             j += 5;
+    }
 
     if (j == 0)
         return apr_pstrmemdup(p, s, i);
Index: httpd-2.2.34/server/util_xml.c
===================================================================
--- httpd-2.2.34.orig/server/util_xml.c
+++ httpd-2.2.34/server/util_xml.c
@@ -81,7 +81,7 @@ AP_DECLARE(int) ap_xml_parse_input(reque
             }
 
             total_read += len;
-            if (limit_xml_body && total_read > limit_xml_body) {
+            if (total_read > limit_xml_body) {
                 ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r,
                               "XML request body is larger than the configured "
                               "limit of %lu", (unsigned long)limit_xml_body);
Index: httpd-2.2.34/docs/manual/mod/core.html.en
===================================================================
--- httpd-2.2.34.orig/docs/manual/mod/core.html.en
+++ httpd-2.2.34/docs/manual/mod/core.html.en
@@ -30,9 +30,9 @@
 <div class="toplang">
 <p><span>Available Languages: </span><a href="../de/mod/core.html" hreflang="de" rel="alternate" title="Deutsch">&nbsp;de&nbsp;</a> |
 <a href="../en/mod/core.html" title="English">&nbsp;en&nbsp;</a> |
-<a href="../fr/mod/core.html" hreflang="fr" rel="alternate" title="Fran�ais">&nbsp;fr&nbsp;</a> |
+<a href="../fr/mod/core.html" hreflang="fr" rel="alternate" title="Fran�ais">&nbsp;fr&nbsp;</a> |
 <a href="../ja/mod/core.html" hreflang="ja" rel="alternate" title="Japanese">&nbsp;ja&nbsp;</a> |
-<a href="../tr/mod/core.html" hreflang="tr" rel="alternate" title="T�rk�e">&nbsp;tr&nbsp;</a></p>
+<a href="../tr/mod/core.html" hreflang="tr" rel="alternate" title="T�rk�e">&nbsp;tr&nbsp;</a></p>
 </div>
 <table class="module"><tr><th><a href="module-dict.html#Description">Description:</a></th><td>Core Apache HTTP Server features that are always
 available</td></tr>
@@ -1496,8 +1496,8 @@ MIME content-type</td></tr>
 <tr><th><a href="directive-dict.html#Compatibility">Compatibility:</a></th><td>2.2.32 or 2.4.24 and later</td></tr>
 </table>
     <p>This directive changes the rules applied to the HTTP Request Line
-    (<a href="https://tools.ietf.org/html/rfc7230#section-3.1.1">RFC 7230 �3.1.1</a>) and the HTTP Request Header Fields
-    (<a href="https://tools.ietf.org/html/rfc7230#section-3.2">RFC 7230 �3.2</a>), which are now applied by default or using
+    (<a href="https://tools.ietf.org/html/rfc7230#section-3.1.1">RFC 7230 �3.1.1</a>) and the HTTP Request Header Fields
+    (<a href="https://tools.ietf.org/html/rfc7230#section-3.2">RFC 7230 �3.2</a>), which are now applied by default or using
     the <code>Strict</code> option. Due to legacy modules, applications or
     custom user-agents which must be deperecated the <code>Unsafe</code>
     option has been added to revert to the legacy behaviors. These rules
@@ -1508,10 +1508,10 @@ MIME content-type</td></tr>
     <p>Prior to the introduction of this directive, the Apache HTTP Server
     request message parsers were tolerant of a number of forms of input
     which did not conform to the protocol.
-    <a href="https://tools.ietf.org/html/rfc7230#section-9.4">RFC 7230 �9.4 Request Splitting</a> and
-    <a href="https://tools.ietf.org/html/rfc7230#section-9.5">�9.5 Response Smuggling</a> call out only two of the potential
+    <a href="https://tools.ietf.org/html/rfc7230#section-9.4">RFC 7230 �9.4 Request Splitting</a> and
+    <a href="https://tools.ietf.org/html/rfc7230#section-9.5">�9.5 Response Smuggling</a> call out only two of the potential
     risks of accepting non-conformant request messages, while
-    <a href="https://tools.ietf.org/html/rfc7230#section-3.5">RFC 7230 �3.5</a> "Message Parsing Robustness" identify the
+    <a href="https://tools.ietf.org/html/rfc7230#section-3.5">RFC 7230 �3.5</a> "Message Parsing Robustness" identify the
     risks of accepting obscure whitespace and request message formatting. 
     As of the introduction of this directive, all grammer rules of the
     specification are enforced in the default <code>Strict</code> operating
@@ -1531,7 +1531,7 @@ MIME content-type</td></tr>
     Users should pay particular attention to the 400 responses in the access
     log for invalid requests which were unexpectedly rejected.</p>
 
-    <p><a href="https://tools.ietf.org/html/rfc7231#section-4.1">RFC 7231 �4.1</a> "Request Methods" "Overview" requires that
+    <p><a href="https://tools.ietf.org/html/rfc7231#section-4.1">RFC 7231 �4.1</a> "Request Methods" "Overview" requires that
     origin servers shall respond with an error when an unsupported method
     is encountered in the request line. This already happens when the
     <code>LenientMethods</code> option is used, but administrators may wish
@@ -1542,7 +1542,7 @@ MIME content-type</td></tr>
     be toggled for forward proxy hosts, as the methods supported by the
     origin servers are unknown to the proxy server.</p>
 
-    <p><a href="https://tools.ietf.org/html/rfc2616#section-19.6">RFC 2616 �19.6</a> "Compatibility With Previous Versions" had
+    <p><a href="https://tools.ietf.org/html/rfc2616#section-19.6">RFC 2616 �19.6</a> "Compatibility With Previous Versions" had
     encouraged HTTP servers to support legacy HTTP/0.9 requests. RFC 7230
     superceeds this with "The expectation to support HTTP/0.9 requests has
     been removed" and offers additional comments in 
@@ -2094,13 +2094,19 @@ from the client</td></tr>
 <tr><th><a href="directive-dict.html#Status">Status:</a></th><td>Core</td></tr>
 <tr><th><a href="directive-dict.html#Module">Module:</a></th><td>core</td></tr>
 </table>
-    <p>Limit (in bytes) on maximum size of an XML-based request
-    body. A value of <code>0</code> will disable any checking.</p>
+    <p>Limit (in bytes) on the maximum size of an XML-based request
+    body. A value of <code>0</code> will apply a hard limit (depending on
+    32bit vs 64bit system) allowing for XML escaping within the bounds of
+    the system addressable memory, but it exists for compatibility only
+    and is not recommended since it does not account for memory consumed
+    elsewhere or concurrent requests, which might result in an overall
+    system out-of-memory.<p>
 
     <p>Example:</p>
 
     <div class="example"><p><code>
-      LimitXMLRequestBody 0
+    # Limit of 1 MiB
+    LimitXMLRequestBody 1073741824
     </code></p></div>
 
 
@@ -3813,9 +3819,9 @@ hostname or IP address</td></tr>
 <div class="bottomlang">
 <p><span>Available Languages: </span><a href="../de/mod/core.html" hreflang="de" rel="alternate" title="Deutsch">&nbsp;de&nbsp;</a> |
 <a href="../en/mod/core.html" title="English">&nbsp;en&nbsp;</a> |
-<a href="../fr/mod/core.html" hreflang="fr" rel="alternate" title="Fran�ais">&nbsp;fr&nbsp;</a> |
+<a href="../fr/mod/core.html" hreflang="fr" rel="alternate" title="Fran�ais">&nbsp;fr&nbsp;</a> |
 <a href="../ja/mod/core.html" hreflang="ja" rel="alternate" title="Japanese">&nbsp;ja&nbsp;</a> |
-<a href="../tr/mod/core.html" hreflang="tr" rel="alternate" title="T�rk�e">&nbsp;tr&nbsp;</a></p>
+<a href="../tr/mod/core.html" hreflang="tr" rel="alternate" title="T�rk�e">&nbsp;tr&nbsp;</a></p>
 </div><div class="top"><a href="#page-header"><img src="../images/up.gif" alt="top" /></a></div><div class="section"><h2><a id="comments_section" name="comments_section">Comments</a></h2><div class="warning"><strong>Notice:</strong><br />This is not a Q&amp;A section. Comments placed here should be pointed towards suggestions on improving the documentation or server, and may be removed again by our moderators if they are either implemented or considered invalid/off-topic. Questions on how to manage the Apache HTTP Server should be directed at either our IRC channel, #httpd, on Freenode, or sent to our <a href="http://httpd.apache.org/lists.html">mailing lists</a>.</div>
 <script type="text/javascript"><!--//--><![CDATA[//><!--
 var comments_shortname = 'httpd';
