Skip to content

Test coverage for mod_sed y/// size mismatch handling (#678) - #766

Closed
notroj wants to merge 2 commits into
apache:trunkfrom
notroj:pr678-testing
Closed

notroj wants to merge 2 commits into
apache:trunkfrom
notroj:pr678-testing

Conversation

@notroj

@notroj notroj commented Sep 17, 2026

Copy link
Copy Markdown
Collaborator

Analysis by @claude:

Adds test/modules/filters/test_002_sed_ycomp.py covering the fix in #678, together with that PR's commit so the new cases have something to run against. It extends the existing test/modules/filters package rather than adding one; env.py gains mod_sed.

Five cases: three y/// expressions whose source is longer than the destination, each of which must be rejected naming the size mismatch and not a missing delimiter; one expression whose destination is longer, which the check after the loop already catches correctly today; and one well-formed y/// that must still compile and start the server. Without #678 the first three fail — the parser keeps advancing past the closing delimiter and past the NUL terminating the config line, so the error finally reported is ending delimiter missing on string: y/abcdef/de/ rather than transform strings not the same size. That misreported error is what makes the out-of-bounds read observable from a test without ASan. With #678 applied, all 21 cases in the package pass.

One deliberate change from #678 as submitted: its CHANGES entry is moved to changes-entries/sed-ycomp-mismatch.txt per README.CHANGES, which also resolves a conflict against the current top of CHANGES. modules/filters/sed0.c is untouched and identical to the PR.

🤖 Generated with Claude Code

notroj and others added 2 commits September 17, 2026 20:56
* test/modules/filters/test_002_sed_ycomp.py: New test suite.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
GitHub: PR apache#678
ycomp() compiles the sed "y/source/dest/" transliterate command by walking
the source and destination strings in lock-step. The first scan loop guards
*tsp against '\0'/'\n', but the second loop reads the destination via *tsp++
with no such guard: it stops only when the source pointer reaches the
delimiter. When the destination string is shorter than the source, tsp runs
past the destination's closing delimiter and the NUL terminator, reading
past the end of the LBSIZE+1 line buffer (commands->linebuf) into adjacent
memory until it happens to hit a matching byte.

The existing size-mismatch check (SEDERR_TSNTSS) already detects this case --
it fires as soon as a destination byte reads back as the delimiter or NUL --
but it only logs and continues, so the over-read proceeds. Make that check
abort compilation (return NULL, as every other error path in ycomp does),
which both fixes the over-read and rejects the malformed command, matching
the behaviour of standard sed ("strings for `y' command are different
lengths").

The sed program is supplied via the OutputSed/InputSed configuration
directives (ACCESS_CONF), so this is a robustness fix for malformed
configuration, not a remotely triggerable issue.

(cherry picked from commit f9e81cc)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant