owasp-modsecurity / owasp-modsecurity/ModSecurity
Memory leak in msc_pregcomp_ex
Nobody has claimed this yet.
- Dominant language
- C++
- Stars
- 9.8k
- Forks
- 1.8k
- Avg merge
- 2h 46m
- Merged PRs (30d)
- 1
Description
apr_pool_cleanup_register() is called at the very end of the function.
In case any problem occurs (e.g., regex cannot compile) we return immediately, so the cleanup is never performed.
apr_pool_cleanup_register() should be called right after calling pcre_compile() to cleanup memory allocated by pcre.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start at msc_pregcomp_ex and trace the pcre_compile() call and the later apr_pool_cleanup_register() registration. Confirm how the early return on a compilation failure leaves PCRE memory unmanaged. Move the cleanup registration to the point described in the issue, then run the existing test suite or relevant regex compilation tests to verify failure paths are cleaned up.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- cpp
- Domain
- security
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100