# DoS via lua_read_body() [zhbug_httpd_94]

mod_lua's r:parsebody(0) allocates Content-Length+1 bytes without limit, so a huge Content-Length triggers OOM abort and crashes httpd.

- Payout: hidden
- Severity: low
- Program: Internet Bug Bounty
- Found by (vendor credit): Ronald Crane (Zippenhop LLC)
- Found by: tdp3kel9g
- Disclosed: 2022-07-09
- CVE: CVE-2022-29404
- Write-up quality: 7/10
- Original: https://hackerone.com/reports/1596252
- Library page: https://bugbountylibrary.com/r/h1%3A1596252
- Tags: area:web domain:web impact:dos kind:bounty platform:hackerone sev:low technique:source-review vuln:dos

**Target:** mod_lua lua_read_body() in modules/lua/lua_request.c
**Root cause:** lua_read_body() allocates length+1 bytes from r->remaining (Content-Length) when maxsize is 0; no default cap, so apr_pcalloc overflows to a huge size and abort_on_oom() calls abort().
**Steps:**
1. Deploy a Lua handler calling `r:parsebody(0)`
2. Send `curl -H "Content-Length: 9223372036854775807" -X POST http://host/bug94/bug94.lua`
3. Observe length=0x7fffffffffffffff, apr_palloc size wraps to 0x8000000000000000
4. allocator_alloc returns NULL, pool->abortfn() -> abort_on_oom() -> abort(), crashing httpd
**How found:** Code review of lua_read_body() noting Content-Length is only bounded to non-negative apr_off_t, not to a sane max, and that maxsize=0 skips the size check; traced through apr_palloc to abort_on_oom.
**Exploitation:** Remote unauthenticated attacker sends a POST with Content-Length 2^63-1 to any Lua endpoint calling r:parsebody(0); the allocation size wraps negative, allocation fails, and the OOM abort handler terminates the process.
**Insight:** When a framework exposes a 'no limit' sentinel (maxsize=0), check whether the underlying allocator still trusts attacker-controlled length fields; integer wrap in length+1 can turn a size check bypass into an OOM abort.