From 493eb23e5cc18c3a7be53977c182ff5d1360c64c Mon Sep 17 00:00:00 2001 From: Eric Covener Date: Sun, 26 Apr 2026 15:48:41 +0000 Subject: [PATCH] Merge r1933340 from trunk: fix length checks in AJP msg_get functions git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1933341 13f79535-47bb-0310-9956-ffa450edef68 --- modules/proxy/ajp_msg.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/modules/proxy/ajp_msg.c b/modules/proxy/ajp_msg.c index 3367b5df4aa..36533c59059 100644 --- a/modules/proxy/ajp_msg.c +++ b/modules/proxy/ajp_msg.c @@ -395,7 +395,7 @@ apr_status_t ajp_msg_get_uint32(ajp_msg_t *msg, apr_uint32_t *rvalue) { apr_uint32_t value; - if ((msg->pos + 3) > msg->len) { + if ((msg->pos + 3) >= msg->len) { return ajp_log_overflow(msg, "ajp_msg_get_uint32"); } @@ -420,7 +420,7 @@ apr_status_t ajp_msg_get_uint16(ajp_msg_t *msg, apr_uint16_t *rvalue) { apr_uint16_t value; - if ((msg->pos + 1) > msg->len) { + if ((msg->pos + 1) >= msg->len) { return ajp_log_overflow(msg, "ajp_msg_get_uint16"); } @@ -443,7 +443,7 @@ apr_status_t ajp_msg_peek_uint16(ajp_msg_t *msg, apr_uint16_t *rvalue) { apr_uint16_t value; - if ((msg->pos + 1) > msg->len) { + if ((msg->pos + 1) >= msg->len) { return ajp_log_overflow(msg, "ajp_msg_peek_uint16"); } @@ -464,7 +464,7 @@ apr_status_t ajp_msg_peek_uint16(ajp_msg_t *msg, apr_uint16_t *rvalue) */ apr_status_t ajp_msg_peek_uint8(ajp_msg_t *msg, apr_byte_t *rvalue) { - if (msg->pos > msg->len) { + if (msg->pos >= msg->len) { return ajp_log_overflow(msg, "ajp_msg_peek_uint8"); } @@ -482,7 +482,7 @@ apr_status_t ajp_msg_peek_uint8(ajp_msg_t *msg, apr_byte_t *rvalue) apr_status_t ajp_msg_get_uint8(ajp_msg_t *msg, apr_byte_t *rvalue) { - if (msg->pos > msg->len) { + if (msg->pos >= msg->len) { return ajp_log_overflow(msg, "ajp_msg_get_uint8"); }