fix: read the request body back from disk in modsecurity_request_body_end_raw

[fzipi]

What

modsecurity_request_body_end_raw (apache2/msc_reqbody.c) now handles a body that was moved to disk: it reads the temporary file back through the existing modsecurity_request_body_retrieve_* API into the raw buffer, sized from the file (msc_reqbody_length only counts the bytes that were stored in memory before the spill), sets msc_reqbody_length to the real size, and leaves the storage mode on disk. modsecurity_request_body_clear frees that buffer, which in this case is not owned by a chunk.

Why

Once a request body exceeds SecRequestBodyInMemoryLimit it is written to a temporary file and the in-memory chunk array is released (msc_reqbody_chunks = NULL). modsecurity_request_body_end_raw still walked that array, so any processor that needs the raw body for such a request crashed the worker with a NULL dereference. In practice that is URLENCODED forced through ctl:requestBodyProcessor on a non form content type, which is what the backtrace in #3300 shows. It only triggers for bodies above the in-memory limit, hence the "only some POSTs" symptom.

Tests

New tests/regression/misc/40-reqbody-disk.t (auto-discovered by the runner): SecRequestBodyInMemoryLimit 64, a text/plain POST of ~215 bytes switched to URLENCODED by ctl, with a rule on ARGS:a and one on REQUEST_BODY.

Verified in a Debian bookworm container (apache2 2.4, --enable-assertions --enable-pcre-study --enable-pcre-jit):

• untouched v2/master: both cases fail with child pid ... exit signal Segmentation fault (11) in error.log;
• this branch: both cases return 403 (String match "1" at ARGS:a, String match "&b=2" at REQUEST_BODY).

References

Fixes #3300

🤖 Generated with Claude Code

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

• Configuration used: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: a4034b15-0483-4133-82a8-72f07fcff6d8

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[sonarqubecloud]

Quality Gate passed

Issues
3 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud