# Read beyond bounds in ap_strcmp_match() [zhbug_httpd_47.7]

Signed int index overflow in ap_strcmp_match() lets a Lua r:strcmp_match() call on a >2GB string read ~0x80000000 bytes before the buffer, leaking string-existence info.

- Payout: hidden
- Severity: low
- Program: Internet Bug Bounty
- Found by (vendor credit): Ronald Crane (Zippenhop LLC)
- Found by: tdp3kel9g
- Disclosed: 2022-07-09
- CVE: CVE-2022-28615
- Write-up quality: 7/10
- Original: https://hackerone.com/reports/1595281
- Library page: https://bugbountylibrary.com/r/h1%3A1595281
- Tags: area:web domain:web impact:data-leak kind:bounty platform:hackerone sev:low technique:chained technique:source-review vuln:info-disclosure vuln:memory-corruption

**Target:** httpd server/util.c ap_strcmp_match() via mod_lua r:strcmp_match()
**Root cause:** ap_strcmp_match() indexes str/expected with signed int x,y; a string longer than INT_MAX overflows x to negative, so str[x] reads memory before the buffer.
**Steps:**
1. Deploy Lua handler calling `r.strcmp_match(r:requestbody(), "*secret*")`.
2. Send POST with `Content-Length: 2147483648` and >2GB of 'a' body bytes.
3. In debugger break on ap_strcmp_match line 196, set conditional BP for x > 0x7fffffff.
4. Observe str[x] referencing str-0x80000000 and marching upward toward str.
**How found:** Code reading of ap_strcmp_match() spotted signed int loop indices over attacker-length strings; hypothesized overflow past INT_MAX and built a POC client plus Lua handler to confirm the negative index.
**Exploitation:** Attacker supplies a >2GB request body to a Lua script that passes it to r:strcmp_match(); the int index wraps negative and the matcher scans ~2GB of pre-buffer heap, returning whether the pattern (e.g. '*secret*') exists in memory.
**Insight:** Audit C string/pattern matchers for signed int loop counters when inputs can exceed INT_MAX; mod_lua's r:strcmp_match() is a reachable sink for such length-driven overflows.