# Read beyond bounds in mod_isapi.c [zhbug_httpd_41]

mod_isapi uses strlen(r->filename) to index the ISAPI-supplied URL string, reading out of bounds when the DLL passes a shorter buffer.

- Payout: hidden
- Severity: low
- Program: Internet Bug Bounty
- Found by (vendor credit): Ronald Crane (Zippenhop LLC)
- Found by: tdp3kel9g
- Disclosed: 2022-07-09
- CVE: CVE-2022-28330
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/1595296
- Library page: https://bugbountylibrary.com/r/h1%3A1595296
- Tags: area:web domain:web impact:data-leak impact:dos kind:bounty platform:hackerone sev:low tech:windows technique:source-review vuln:dos vuln:info-disclosure vuln:memory-corruption

**Target:** mod_isapi.c HSE_REQ_MAP_URL_TO_PATH handler on Windows
**Root cause:** len is computed from strlen(r->filename) (the DLL's filesystem path) but used to index file, the unrelated string supplied by the ISAPI extension via ServerSupportFunction, so file[len-1] reads past the buffer when the supplied string is shorter.
**Steps:**
1. Configure httpd.conf with `<Location /bug41> AddHandler isapi-handler .dll` and place foo.dll in /bug41
2. Build foo.dll whose HttpExtensionProc calls ServerSupportFunction(HSE_REQ_MAP_URL_TO_PATH, buf, &bufSize, NULL) with buf="" (length 0)
3. Request `<server>/bug41/foo.dll`
4. Break on line 969/979; observe len = strlen(r->filename) e.g. 27 while file points to a 0-length string
5. Step line 983: `file[len - 1] != '/'` reads one byte at offset len-1 beyond the end of file
**How found:** Code review of mod_isapi.c: noticed len derived from r->filename but used to index the DLL-provided file buffer, a length/pointer mismatch; confirmed with a debugger PoC DLL.
**Exploitation:** Requires victim site to run an ISAPI extension DLL that calls HSE_REQ_MAP_URL_TO_PATH with a buffer shorter than the DLL's filesystem path; the OOB byte influences the branch and may be reflected back to the requester or crash the worker.
**Insight:** In ISAPI/extension callbacks, watch for length variables computed from one buffer (server-side path) but used to index a different caller-supplied buffer; mismatched provenance of length vs pointer is the tell.