diff --git a/changes-entries/lua-parsebody-off-t.txt b/changes-entries/lua-parsebody-off-t.txt new file mode 100644 index 00000000000..26dd03e6457 --- /dev/null +++ b/changes-entries/lua-parsebody-off-t.txt @@ -0,0 +1,4 @@ + *) mod_lua: Fix a stack write past a 4-byte object in r:parsebody() where + the body length was read through an apr_off_t* aliased onto an apr_size_t, + corrupting adjacent stack on builds with sizeof(apr_off_t) > sizeof(apr_size_t) + (32-bit large-file). [arshiya tabasum] diff --git a/modules/lua/lua_request.c b/modules/lua/lua_request.c index 587b690c6fa..6843679006b 100644 --- a/modules/lua/lua_request.c +++ b/modules/lua/lua_request.c @@ -399,9 +399,11 @@ static int req_parsebody(lua_State *L) int i; size_t vlen = 0; size_t len = 0; - if (lua_read_body(r, &data, (apr_off_t*) &size, max_post_size) != OK) { + apr_off_t body_len = 0; + if (lua_read_body(r, &data, &body_len, max_post_size) != OK) { return 2; } + size = (apr_size_t) body_len; len = strlen(multipart); i = 0; for