owasp-modsecurity / owasp-modsecurity/ModSecurity

Memory leak in msc_pregcomp_ex

Open
#2,407 2 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

2.x
Dominant language
C++
Stars
9.8k
Forks
1.8k
Avg merge
2h 46m
Merged PRs (30d)
1

Description

apr_pool_cleanup_register() is called at the very end of the function.
In case any problem occurs (e.g., regex cannot compile) we return immediately, so the cleanup is never performed.

apr_pool_cleanup_register() should be called right after calling pcre_compile() to cleanup memory allocated by pcre.

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start at msc_pregcomp_ex and trace the pcre_compile() call and the later apr_pool_cleanup_register() registration. Confirm how the early return on a compilation failure leaves PCRE memory unmanaged. Move the cleanup registration to the point described in the issue, then run the existing test suite or relevant regex compilation tests to verify failure paths are cleaned up.

Written by the indexing model from the issue text.

Assessment

Tech stack
cpp
Domain
security
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.