From 76e222bcb77ba8452e5da4e82ae6cecd499c25e0 Mon Sep 17 00:00:00 2001 From: krispybyte Date: Sat, 21 Jun 2025 23:33:50 +0300 Subject: [PATCH] Fix heap overflow in directory URI slash redirection CVE: CVE-2025-55763 Upstream: https://github.com/civetweb/civetweb/commit/76e222bcb77ba8452e5da4e82ae6cecd499c25e0 [thomas: fix offset] Signed-off-by: Thomas Perale --- src/civetweb.c | 23 ++++++++++++++++++----- 1 file changed, 18 insertions(+), 5 deletions(-) diff --git a/src/civetweb.c b/src/civetweb.c index bbc9aa8be..e969c939f 100644 --- a/src/civetweb.c +++ b/src/civetweb.c @@ -15242,7 +15242,6 @@ handle_request(struct mg_connection *conn) /* 12. Directory uris should end with a slash */ if (file.stat.is_directory && ((uri_len = (int)strlen(ri->local_uri)) > 0) && (ri->local_uri[uri_len - 1] != '/')) { - /* Path + server root */ size_t buflen = UTF8_PATH_MAX * 2 + 2; char *new_path; @@ -15254,12 +15254,26 @@ handle_request(struct mg_connection *conn) mg_send_http_error(conn, 500, "out or memory"); } else { mg_get_request_link(conn, new_path, buflen - 1); - strcat(new_path, "/"); + + size_t len = strlen(new_path); + if (len + 1 < buflen) { + new_path[len] = '/'; + new_path[len + 1] = '\0'; + len += 1; + } + if (ri->query_string) { - /* Append ? and query string */ - strcat(new_path, "?"); - strcat(new_path, ri->query_string); + if (len + 1 < buflen) { + new_path[len] = '?'; + new_path[len + 1] = '\0'; + len += 1; + } + + /* Append with size of space left for query string + null terminator */ + size_t max_append = buflen - len - 1; + strncat(new_path, ri->query_string, max_append); } + mg_send_http_redirect(conn, new_path, 301); mg_free(new_path); }