From d1b4b70f960dad00ca03b049ce60f09cd864688d Mon Sep 17 00:00:00 2001 From: arshiya tabasum Date: Mon, 13 Jul 2026 14:06:05 +0530 Subject: [PATCH] reject too-short PROXY v2 address length in mod_remoteip --- docs/log-message-tags/next-number | 2 +- modules/metadata/mod_remoteip.c | 14 ++++++++++++++ 2 files changed, 15 insertions(+), 1 deletion(-) diff --git a/docs/log-message-tags/next-number b/docs/log-message-tags/next-number index e056af744b5..afde5353f30 100644 --- a/docs/log-message-tags/next-number +++ b/docs/log-message-tags/next-number @@ -1 +1 @@ -10595 +10597 diff --git a/modules/metadata/mod_remoteip.c b/modules/metadata/mod_remoteip.c index 27a42d3cd37..f34831a4cc9 100644 --- a/modules/metadata/mod_remoteip.c +++ b/modules/metadata/mod_remoteip.c @@ -954,6 +954,13 @@ static remoteip_parse_status_t remoteip_process_v2_header(conn_rec *c, case 0x01: /* PROXY command */ switch (hdr->v2.fam) { case 0x11: /* TCPv4 */ + if (ntohs(hdr->v2.len) < sizeof(hdr->v2.addr.ip4)) { + ap_log_cerror(APLOG_MARK, APLOG_ERR, 0, c, APLOGNO(10595) + "RemoteIPProxyProtocol: address length %hu " + "too short for TCPv4", + (unsigned short)ntohs(hdr->v2.len)); + return HDR_ERROR; + } ret = apr_sockaddr_info_get(&conn_conf->client_addr, NULL, APR_INET, ntohs(hdr->v2.addr.ip4.src_port), @@ -971,6 +978,13 @@ static remoteip_parse_status_t remoteip_process_v2_header(conn_rec *c, case 0x21: /* TCPv6 */ #if APR_HAVE_IPV6 + if (ntohs(hdr->v2.len) < sizeof(hdr->v2.addr.ip6)) { + ap_log_cerror(APLOG_MARK, APLOG_ERR, 0, c, APLOGNO(10596) + "RemoteIPProxyProtocol: address length %hu " + "too short for TCPv6", + (unsigned short)ntohs(hdr->v2.len)); + return HDR_ERROR; + } ret = apr_sockaddr_info_get(&conn_conf->client_addr, NULL, APR_INET6, ntohs(hdr->v2.addr.ip6.src_port),