#! /bin/sh /usr/share/dpatch/dpatch-run
# Description: fix arbitrary code execution via crafted SetEnvIf directive
# Origin: upstream, http://svn.apache.org/viewvc?view=revision&revision=1227280
# Bug-Ubuntu: https://bugs.launchpad.net/ubuntu/+source/apache2/+bug/811422

@DPATCH@
diff -urNad '--exclude=CVS' '--exclude=.svn' '--exclude=.git' '--exclude=.arch' '--exclude=.hg' '--exclude=_darcs' '--exclude=.bzr' apache2-2.2.17~/server/util.c apache2-2.2.17/server/util.c
--- apache2-2.2.17~/server/util.c	2010-10-07 12:56:54.000000000 -0400
+++ apache2-2.2.17/server/util.c	2012-02-14 10:01:20.736418301 -0500
@@ -82,6 +82,8 @@
 #define IS_SLASH(s) (s == '/')
 #endif
 
+/* same as APR_SIZE_MAX which doesn't appear until APR 1.3 */
+#define UTIL_SIZE_MAX (~((apr_size_t)0))
 
 /*
  * Examine a field value (such as a media-/content-type) string and return
@@ -366,7 +368,7 @@
     char *dest, *dst;
     char c;
     size_t no;
-    int len;
+    apr_size_t len;
 
     if (!source)
         return NULL;
@@ -391,6 +393,11 @@
             len++;
         }
         else if (no < nmatch && pmatch[no].rm_so < pmatch[no].rm_eo) {
+            if (UTIL_SIZE_MAX - len <= pmatch[no].rm_eo - pmatch[no].rm_so) {
+                ap_log_error(APLOG_MARK, APLOG_WARNING, 0, NULL,
+                             "integer overflow or out of memory condition." );
+                return NULL;
+            }
             len += pmatch[no].rm_eo - pmatch[no].rm_so;
         }
 
