modsec2_pcre_memleak_poc.c

#include <stdio.h>
#include <stdlib.h>

#include "api.h"

const char * url = "/remote.php/dav/files/";

void logMessage(void *obj, int level, char *str) {  printf("%s\n", str); }

apr_status_t readbody(request_rec *r, char *buf, unsigned int length, unsigned int *readcnt, int *is_eos) {
    strcpy(buf, "x="); *readcnt = 2; *is_eos = 1;
    return APR_SUCCESS;
}

unsigned int responsepos = 0;

apr_status_t readresponse(request_rec *r, char *buf, unsigned int length, unsigned int *readcnt, int *is_eos) {
    strcpy(buf, "ok"); *readcnt = 2; *is_eos = 1;
    return APR_SUCCESS;
}

void feed_tx(directory_config * config) {
    conn_rec * c;
    request_rec * r;

    c = modsecNewConnection();
    modsecProcessConnection(c);
    r = modsecNewRequest(c, config);

    r->method = "PUT"; r->method_number = M_PUT;
    r->protocol = "1.1";

    apr_table_setn(r->headers_in, "Host", "example.com");
    apr_table_setn(r->headers_in, "Content-Length", "2");
    //apr_table_setn(r->headers_in, "Content-Type", "application/x-www-form-urlencodet;charset=x");
    apr_table_setn(r->headers_in, "Content-Type", "application/x-www-form-urlencoded");

    r->content_type = apr_table_get(r->headers_in, "Content-Type");
    r->hostname = apr_table_get(r->headers_in, "Host");
    r->path_info = apr_pstrdup(r->pool, url);
    
    r->args = NULL;
    char *rawurl = apr_pstrdup(r->pool, url);

    r->request_time = apr_time_now();

    r->parsed_uri.scheme = "http";
    r->parsed_uri.path = r->path_info;
    r->parsed_uri.hostname = (char *)r->hostname;
    r->parsed_uri.is_initialized = 1;
    r->parsed_uri.port = 80; r->parsed_uri.port_str = "80";
    r->parsed_uri.dns_looked_up = 0; r->parsed_uri.dns_resolved = 0;
    r->parsed_uri.user = NULL; r->parsed_uri.password = NULL;
    r->parsed_uri.fragment = NULL;

    r->unparsed_uri = rawurl; r->uri = r->unparsed_uri;

    r->the_request = (char *)apr_palloc(r->pool, strlen(r->method) + 1 + strlen(r->uri) + 1 + strlen(r->protocol) + 1);

    strcpy(r->the_request, r->method);
    strcat(r->the_request, " ");
    strcat(r->the_request, r->uri);
    strcat(r->the_request, " ");
    strcat(r->the_request, r->protocol);

    modsecProcessRequest(r);

    r->status = 200;
    r->status_line = "";

    apr_table_setn(r->headers_out, "Server", "nginx");
    apr_table_setn(r->headers_out, "Content-Length", "2");
    
    modsecProcessResponse(r);
    modsecFinishRequest(r);
    modsecFinishConnection(c);
}

int main(int argc, char ** argv) {
    int req_number = 50000;

    if (argc > 1) {
        req_number = atoi(argv[1]);
    }

    printf("feeding %d requests to modsec\n", req_number);

    modsecSetLogHook(NULL, logMessage);

    modsecSetReadBody(readbody);
    modsecSetReadResponse(readresponse);

    modsecInit();
    modsecStartConfig();

    directory_config * config = modsecGetDefaultConfig();

    const char * err = modsecProcessConfig(config, "test.conf", ".");

    if (err != NULL) {
        fprintf(stderr, "Failed to load config: %s\n", err);
        return 1;
    }

    modsecFinalizeConfig();

    modsecInitProcess();

    for (int i = 0; i < req_number; i++) {
       feed_tx(config);
    }

    getchar();

    return 0;
}