From 47f2bffc76e1b001ce657acad2c32736ae2fc6f0 Mon Sep 17 00:00:00 2001 From: Jeff <88594453+LaptopsPlural@users.noreply.github.com> Date: Fri, 11 Sep 2026 18:36:48 +0000 Subject: [PATCH 1/2] varbuf: add optional -fbounds-safety annotations for struct ap_varbuf Introduce inert AP_SIZED_BY*_ macros (OFF by default) and annotate the ap_varbuf buf/avail pair. Capacity-first assign in large-grow/init/free. Default builds unchanged; ENABLE_FBOUNDS_SAFETY / --enable-fbounds-safety opt-in for experimental Clang toolchains. --- CMakeLists.txt | 19 +++++++ NOTES.md | 109 +++++++++++++++++++++++++++++++++++++ configure.in | 20 +++++++ include/ap_bounds_safety.h | 56 +++++++++++++++++++ include/util_varbuf.h | 9 ++- server/util.c | 9 ++- 6 files changed, 218 insertions(+), 4 deletions(-) create mode 100644 NOTES.md create mode 100644 include/ap_bounds_safety.h diff --git a/CMakeLists.txt b/CMakeLists.txt index 4ba2c9cfb88..8dacc4a95c5 100644 --- a/CMakeLists.txt +++ b/CMakeLists.txt @@ -127,6 +127,16 @@ SET(CHECK_LIBRARIES "${default_check_libraries}" CACHE STRING "Check lib OPTION(INSTALL_PDB "Install .pdb files (if generated)" ON) OPTION(INSTALL_MANUAL "Install manual" ON) +# Optional Clang -fbounds-safety. Default OFF: AP_*SIZED_BY* / AP_*COUNTED_BY* +# macros in include/ap_bounds_safety.h are inert and the ABI/build is unchanged. +# When ON, requires a Clang that provides -fbounds-safety / . +OPTION(ENABLE_FBOUNDS_SAFETY "Enable experimental Clang -fbounds-safety annotations (OFF by default)" OFF) +IF(ENABLE_FBOUNDS_SAFETY) + MESSAGE(STATUS "ENABLE_FBOUNDS_SAFETY enabled") +ELSE() + MESSAGE(STATUS "ENABLE_FBOUNDS_SAFETY disabled") +ENDIF() + SET(ENABLE_MODULES "O" CACHE STRING "Minimum module enablement (e.g., \"i\" to build all but those without prerequisites)") SET(WITH_MODULES "" CACHE STRING "comma-separated paths to single-file modules to statically link into the server") SET(EXTRA_INCLUDES "" CACHE STRING "Extra include directories") @@ -993,6 +1003,14 @@ SET_TARGET_PROPERTIES(httpd PROPERTIES ) TARGET_LINK_LIBRARIES(httpd libhttpd ${EXTRA_LIBS}) +# Optional -fbounds-safety (inert macros unless ENABLE_FBOUNDS_SAFETY) +IF(ENABLE_FBOUNDS_SAFETY) + TARGET_COMPILE_DEFINITIONS(libhttpd PRIVATE AP_SUPPORT_FBOUNDS_SAFETY) + TARGET_COMPILE_OPTIONS(libhttpd PRIVATE -fbounds-safety) + TARGET_COMPILE_DEFINITIONS(httpd PRIVATE AP_SUPPORT_FBOUNDS_SAFETY) + TARGET_COMPILE_OPTIONS(httpd PRIVATE -fbounds-safety) +ENDIF() + SET(standard_support htcacheclean htdbm @@ -1266,6 +1284,7 @@ MESSAGE(STATUS " Jansson libraries ............... : ${JANSSON_LIBRARIES}") MESSAGE(STATUS " Extra include directories ....... : ${EXTRA_INCLUDES}") MESSAGE(STATUS " Extra compile flags ............. : ${EXTRA_COMPILE_FLAGS}") MESSAGE(STATUS " Extra libraries ................. : ${EXTRA_LIBS}") +MESSAGE(STATUS " ENABLE_FBOUNDS_SAFETY ........... : ${ENABLE_FBOUNDS_SAFETY}") MESSAGE(STATUS " Modules built and loaded:") FOREACH(mod ${mods_built_and_loaded}) diff --git a/NOTES.md b/NOTES.md new file mode 100644 index 00000000000..3c5fc25e139 --- /dev/null +++ b/NOTES.md @@ -0,0 +1,109 @@ +# Google Patch Rewards — Apache httpd local draft notes + +**Date:** 2026-09-11 (America/Chicago) +**Do not claim yet:** need upstream merge + ≥30 days, then https://bughunters.google.com/report/patch_rewards + +## Chosen target + why + +- **Project:** Apache HTTP Server (httpd) (Tier-1 · High-profile web and mail servers — Google Patch Rewards memory-safety track) +- **Upstream:** https://github.com/apache/httpd (mirror of https://svn.apache.org/repos/asf/httpd/httpd/; prefer `trunk`) +- **Local clone:** `/workspace/google-patch-httpd` +- **Branch:** `local/varbuf-fbounds-safety` (from `trunk`) +- **Why this target:** + 1. Widely deployed HTTP server; `ap_varbuf` backs config getline, expr eval, authz/groupfile, proxy_html, substitute, and related paths that grow buffers from untrusted / config / request-derived input. + 2. Clear, mergeable first-CL scope: **one** buffer+capacity pair — `struct ap_varbuf` (`buf` ↔ `avail`) — textbook `__sized_by`, not a whole-tree sweep. + 3. Same pattern as libpng / libwebp / giflib / lz4 / zstd / libzip / lighttpd: **inert macros** when the flag is off; experimental Clang `-fbounds-safety` only when explicitly enabled. + 4. Stable layout preserved (no field reorder); annotation links `buf` to its **byte capacity** (`avail + 1`, because `avail` is documented as allocated size minus the final NUL). + 5. Not already done upstream (no `__sized_by` / `-fbounds-safety` in tree; GitHub issue/PR search for fbounds/sized_by/counted_by/bounds-safety on `apache/httpd` returned **0** on 2026-09-11). + 6. AI CONTRIBUTING gate clear (no CONTRIBUTING.md; no AI ban in README / SECURITY.md / STATUS / ABOUT_APACHE / `.github/workflows`). + +**Why `buf`/`avail` over `strlen` or other containers:** `avail` is the allocation companion (capacity minus one for the trailing NUL); `strlen` is the live length (or `AP_VARBUF_UNKNOWN`) and is not the correct sized_by companion. APR buckets / brigade buffers are natural follow-ups. + +**ABI / layout note:** Field order is preserved (`buf` remains before `avail`). Small-grow path already assigned **capacity then pointer**; this CL flips the **large-grow** path (and init/free) to the same order. No `ap_mmn.h` bump — annotations are type sugar / empty macros and do not change layout or ABI. + +## Security benefit + +`struct ap_varbuf` is the shared resizable buffer used across config parsing (`ap_varbuf_cfg_getline`), expression evaluation, and several modules. Callers already track capacity in `avail`, but the compiler cannot see that `buf` is bounded by that field (+1 for the NUL byte the API always reserves). + +This draft: + +1. Introduces `include/ap_bounds_safety.h` with `AP_SIZED_BY` / `AP_SIZED_BY_OR_NULL` / `AP_COUNTED_BY*` (empty by default). +2. Annotates **only** `ap_varbuf.buf` → `AP_SIZED_BY_OR_NULL(avail + 1)` (byte capacity; OR_NULL for `ap_varbuf_free()`'s NULL). +3. Keeps existing field order. Makes large-grow (and init/free) assign **capacity before pointer**; documents small-grow already did. +4. Wires optional CMake `ENABLE_FBOUNDS_SAFETY` / autotools `--enable-fbounds-safety` (default **OFF**) → `-DAP_SUPPORT_FBOUNDS_SAFETY` + `-fbounds-safety`. + +**Default builds are unchanged:** macros expand to nothing; no new runtime checks without the experimental flag. New header installs with `include/*.h` (same as other public headers); macros remain inert unless the opt-in is enabled. + +## Files changed + +| File | Change | +|------|--------| +| `include/ap_bounds_safety.h` | **New** — inert / Clang bounds macros | +| `include/util_varbuf.h` | Include header; annotate `ap_varbuf.buf` | +| `server/util.c` | Capacity-first assign in large-grow / init / free; comment on small-grow | +| `CMakeLists.txt` | `ENABLE_FBOUNDS_SAFETY` option OFF + apply flags when ON | +| `configure.in` | `--enable-fbounds-safety` (default no) | +| `NOTES.md` | This file | + +## Verified locally 2026-09-11 + +| Check | Result | +|-------|--------| +| Default `--enable-fbounds-safety` unset (OFF) `./configure` + `make -j` (httpd + modules) | **PASS** (gcc; `httpd` + `server/libmain.a`; configure printed `ENABLE_FBOUNDS_SAFETY disabled`) | +| `ENABLE_FBOUNDS_SAFETY=ON` / `--enable-fbounds-safety` | **Not feasible on this box** — needs Clang with `-fbounds-safety` / `ptrcheck.h` | + +## How to build / test + +Default (macros inert — must stay green): + +```sh +# Autotools (primary Unix path) +./buildconf +./configure --enable-fbounds-safety=no +make -j +# or CMake (primarily Windows / documented in README.cmake): +cmake -S . -B build -DENABLE_FBOUNDS_SAFETY=OFF +cmake --build build -j +``` + +With experimental bounds-safety toolchain (maintainers / CI; **not** available on this box — no Clang/`ptrcheck.h`): + +```sh +./configure --enable-fbounds-safety \ + CC= +make -j +# or: +cmake -S . -B build-fbs -DENABLE_FBOUNDS_SAFETY=ON \ + -DCMAKE_C_COMPILER= +cmake --build build-fbs -j +``` + +## Upstream submit plan + +1. Open a focused GitHub PR against `apache/httpd` branch **`trunk`** (or send to `dev@httpd.apache.org` per project preference / GitBox). +2. Proposed title: `varbuf: add optional -fbounds-safety annotations for struct ap_varbuf` +3. Frame as secure-by-design / Safe Buffers-style systematization of the existing buf+avail pair; cite libwebp/libpng/lz4/zstd/libzip prior art and Google Patch Rewards memory-safety goals. +4. Emphasize: default build behavior unchanged; flag OFF; no PoC / no CVE claim; public layout field order unchanged; no MMN bump. +5. Do **not** claim on https://bughunters.google.com/report/patch_rewards until **merge + ≥30 days**. + +## Follow-ups (separate CLs) + +- Other core buffer+size pairs on request/config paths as diagnostics under a real `-fbounds-safety` build dictate +- Module-local growable buffers that mirror `ap_varbuf` patterns +- APR brigade / bucket data pointers where a stable capacity companion exists (coordinate with APR) + +## AI gate + +- **No `CONTRIBUTING.md`** in upstream tree. +- Searched README, SECURITY.md, STATUS, ABOUT_APACHE, `.github/workflows/` — **no AI / LLM / Copilot ban**. +- **AI gate: CLEAR** (no ban found). + +## Overlap check + +- In-tree: no `__sized_by` / `-fbounds-safety` / `ptrcheck.h` references. +- GitHub `apache/httpd` search (fbounds / sized_by / counted_by / bounds-safety): **0** issues/PRs (2026-09-11). +- **PARK ON OVERLAP:** if an overlapping annotation PR appears before submit, do not race — coordinate or defer. + +## Status + +**LOCAL DRAFT ONLY** — commit on `local/varbuf-fbounds-safety`. Do **not** push/PR from this agent run. Still **no claim** until merge + ≥30 days unreverted. diff --git a/configure.in b/configure.in index 58e996c4537..1b2a43d36d8 100644 --- a/configure.in +++ b/configure.in @@ -731,6 +731,26 @@ fi APACHE_SUBST(PICFLAGS) APACHE_SUBST(PILDFLAGS) +dnl Optional Clang -fbounds-safety. Default no: AP_*SIZED_BY* / AP_*COUNTED_BY* +dnl macros in include/ap_bounds_safety.h are inert and the ABI/build is unchanged. +dnl When yes, requires a Clang that provides -fbounds-safety / . +AC_ARG_ENABLE(fbounds-safety, +APACHE_HELP_STRING(--enable-fbounds-safety,Enable experimental Clang -fbounds-safety annotations), +[ + if test "$enableval" = "yes"; then + enable_fbounds_safety=yes + else + enable_fbounds_safety=no + fi +], +[enable_fbounds_safety=no]) +if test "$enable_fbounds_safety" = "yes"; then + AC_MSG_NOTICE([ENABLE_FBOUNDS_SAFETY enabled]) + APR_ADDTO(CFLAGS,[-DAP_SUPPORT_FBOUNDS_SAFETY -fbounds-safety]) +else + AC_MSG_NOTICE([ENABLE_FBOUNDS_SAFETY disabled]) +fi + ap_reduced_exports=no EXPORTS_DOT_C=exports.c LIBMAIN_LIB=server/libmain.la diff --git a/include/ap_bounds_safety.h b/include/ap_bounds_safety.h new file mode 100644 index 00000000000..ee0e0ed7fa8 --- /dev/null +++ b/include/ap_bounds_safety.h @@ -0,0 +1,56 @@ +/* Licensed to the Apache Software Foundation (ASF) under one or more + * contributor license agreements. See the NOTICE file distributed with + * this work for additional information regarding copyright ownership. + * The ASF licenses this file to You under the Apache License, Version 2.0 + * (the "License"); you may not use this file except in compliance with + * the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +/** + * @file ap_bounds_safety.h + * @brief Portability macros for optional Clang -fbounds-safety + * + * When AP_SUPPORT_FBOUNDS_SAFETY is defined (typically via + * -DAP_SUPPORT_FBOUNDS_SAFETY and a Clang toolchain that implements + * -fbounds-safety), these macros expand to Clang bounds annotations. + * Otherwise they expand to nothing so default builds are unchanged. + * + * Pattern matches libwebp / libpng / giflib / lz4 / zstd / libzip + * inert-macro -fbounds-safety adoption: annotations are inert unless + * explicitly enabled. + */ + +#ifndef AP_BOUNDS_SAFETY_H +#define AP_BOUNDS_SAFETY_H + +#ifdef AP_SUPPORT_FBOUNDS_SAFETY + +# include +/* Non-ABI-breaking sized-by annotations for byte buffers whose companion + * field / argument is a capacity in bytes (e.g. ap_varbuf.avail + 1). + * Prefer AP_SIZED_BY for buffers that are non-NULL when live; use + * *_OR_NULL when the pointer may be NULL (e.g. after ap_varbuf_free()). + */ +# define AP_SIZED_BY(n) __sized_by(n) +# define AP_SIZED_BY_OR_NULL(n) __sized_by_or_null(n) +# define AP_COUNTED_BY(n) __counted_by(n) +# define AP_COUNTED_BY_OR_NULL(n) __counted_by_or_null(n) + +#else /* !AP_SUPPORT_FBOUNDS_SAFETY */ + +# define AP_SIZED_BY(n) +# define AP_SIZED_BY_OR_NULL(n) +# define AP_COUNTED_BY(n) +# define AP_COUNTED_BY_OR_NULL(n) + +#endif /* AP_SUPPORT_FBOUNDS_SAFETY */ + +#endif /* AP_BOUNDS_SAFETY_H */ diff --git a/include/util_varbuf.h b/include/util_varbuf.h index 8e45578e04f..b42f92f3bbf 100644 --- a/include/util_varbuf.h +++ b/include/util_varbuf.h @@ -35,6 +35,7 @@ #include "apr_allocator.h" #include "httpd.h" +#include "ap_bounds_safety.h" /* optional -fbounds-safety macros */ #ifdef __cplusplus extern "C" { @@ -46,8 +47,12 @@ struct ap_varbuf_info; /** A resizable buffer. */ struct ap_varbuf { /** The actual buffer; will point to a const '\\0' if avail == 0 and - * to memory of the same lifetime as the pool otherwise. */ - char *buf; + * to memory of the same lifetime as the pool otherwise. + * Bound is avail + 1 bytes (avail is capacity minus the final \\0); + * OR_NULL covers ap_varbuf_free()'s NULL. Field order preserved; + * update sites assign capacity before the pointer so sized-by + * invariants hold under optional -fbounds-safety builds. */ + char *AP_SIZED_BY_OR_NULL(avail + 1) buf; /** Allocated size of the buffer (minus one for the final \\0); * must only be changed using ap_varbuf_grow(). */ diff --git a/server/util.c b/server/util.c index d1d06fc15b4..d8af955bd7e 100644 --- a/server/util.c +++ b/server/util.c @@ -3071,8 +3071,9 @@ static char * const varbuf_empty = (char *)&nul; AP_DECLARE(void) ap_varbuf_init(apr_pool_t *p, struct ap_varbuf *vb, apr_size_t init_size) { - vb->buf = varbuf_empty; + /* Capacity before pointer so sized_by invariants hold under -fbounds-safety. */ vb->avail = 0; + vb->buf = varbuf_empty; vb->strlen = AP_VARBUF_UNKNOWN; vb->pool = p; vb->info = NULL; @@ -3126,6 +3127,7 @@ AP_DECLARE(void) ap_varbuf_grow(struct ap_varbuf *vb, apr_size_t new_len) else { *new = '\0'; } + /* Capacity before pointer (already ordered for sized_by). */ vb->avail = new_len - 1; vb->buf = new; return; @@ -3166,8 +3168,9 @@ AP_DECLARE(void) ap_varbuf_grow(struct ap_varbuf *vb, apr_size_t new_len) apr_pool_cleanup_register(vb->pool, new_info, varbuf_cleanup, apr_pool_cleanup_null); vb->info = new_info; - vb->buf = new; + /* Capacity before pointer so sized_by invariants hold under -fbounds-safety. */ vb->avail = new_len - 1; + vb->buf = new; } AP_DECLARE(void) ap_varbuf_strmemcat(struct ap_varbuf *vb, const char *str, @@ -3196,6 +3199,8 @@ AP_DECLARE(void) ap_varbuf_free(struct ap_varbuf *vb) apr_pool_cleanup_run(vb->pool, vb->info, varbuf_cleanup); vb->info = NULL; } + /* Capacity before pointer; NULL allowed via AP_SIZED_BY_OR_NULL. */ + vb->avail = 0; vb->buf = NULL; } From 7017dfc1e83f0c1fd9605241229103c8768bb366 Mon Sep 17 00:00:00 2001 From: Jeff <88594453+LaptopsPlural@users.noreply.github.com> Date: Sat, 12 Sep 2026 03:27:37 +0000 Subject: [PATCH 2/2] Remove non-upstream documentation file --- NOTES.md | 109 ------------------------------------------------------- 1 file changed, 109 deletions(-) delete mode 100644 NOTES.md diff --git a/NOTES.md b/NOTES.md deleted file mode 100644 index 3c5fc25e139..00000000000 --- a/NOTES.md +++ /dev/null @@ -1,109 +0,0 @@ -# Google Patch Rewards — Apache httpd local draft notes - -**Date:** 2026-09-11 (America/Chicago) -**Do not claim yet:** need upstream merge + ≥30 days, then https://bughunters.google.com/report/patch_rewards - -## Chosen target + why - -- **Project:** Apache HTTP Server (httpd) (Tier-1 · High-profile web and mail servers — Google Patch Rewards memory-safety track) -- **Upstream:** https://github.com/apache/httpd (mirror of https://svn.apache.org/repos/asf/httpd/httpd/; prefer `trunk`) -- **Local clone:** `/workspace/google-patch-httpd` -- **Branch:** `local/varbuf-fbounds-safety` (from `trunk`) -- **Why this target:** - 1. Widely deployed HTTP server; `ap_varbuf` backs config getline, expr eval, authz/groupfile, proxy_html, substitute, and related paths that grow buffers from untrusted / config / request-derived input. - 2. Clear, mergeable first-CL scope: **one** buffer+capacity pair — `struct ap_varbuf` (`buf` ↔ `avail`) — textbook `__sized_by`, not a whole-tree sweep. - 3. Same pattern as libpng / libwebp / giflib / lz4 / zstd / libzip / lighttpd: **inert macros** when the flag is off; experimental Clang `-fbounds-safety` only when explicitly enabled. - 4. Stable layout preserved (no field reorder); annotation links `buf` to its **byte capacity** (`avail + 1`, because `avail` is documented as allocated size minus the final NUL). - 5. Not already done upstream (no `__sized_by` / `-fbounds-safety` in tree; GitHub issue/PR search for fbounds/sized_by/counted_by/bounds-safety on `apache/httpd` returned **0** on 2026-09-11). - 6. AI CONTRIBUTING gate clear (no CONTRIBUTING.md; no AI ban in README / SECURITY.md / STATUS / ABOUT_APACHE / `.github/workflows`). - -**Why `buf`/`avail` over `strlen` or other containers:** `avail` is the allocation companion (capacity minus one for the trailing NUL); `strlen` is the live length (or `AP_VARBUF_UNKNOWN`) and is not the correct sized_by companion. APR buckets / brigade buffers are natural follow-ups. - -**ABI / layout note:** Field order is preserved (`buf` remains before `avail`). Small-grow path already assigned **capacity then pointer**; this CL flips the **large-grow** path (and init/free) to the same order. No `ap_mmn.h` bump — annotations are type sugar / empty macros and do not change layout or ABI. - -## Security benefit - -`struct ap_varbuf` is the shared resizable buffer used across config parsing (`ap_varbuf_cfg_getline`), expression evaluation, and several modules. Callers already track capacity in `avail`, but the compiler cannot see that `buf` is bounded by that field (+1 for the NUL byte the API always reserves). - -This draft: - -1. Introduces `include/ap_bounds_safety.h` with `AP_SIZED_BY` / `AP_SIZED_BY_OR_NULL` / `AP_COUNTED_BY*` (empty by default). -2. Annotates **only** `ap_varbuf.buf` → `AP_SIZED_BY_OR_NULL(avail + 1)` (byte capacity; OR_NULL for `ap_varbuf_free()`'s NULL). -3. Keeps existing field order. Makes large-grow (and init/free) assign **capacity before pointer**; documents small-grow already did. -4. Wires optional CMake `ENABLE_FBOUNDS_SAFETY` / autotools `--enable-fbounds-safety` (default **OFF**) → `-DAP_SUPPORT_FBOUNDS_SAFETY` + `-fbounds-safety`. - -**Default builds are unchanged:** macros expand to nothing; no new runtime checks without the experimental flag. New header installs with `include/*.h` (same as other public headers); macros remain inert unless the opt-in is enabled. - -## Files changed - -| File | Change | -|------|--------| -| `include/ap_bounds_safety.h` | **New** — inert / Clang bounds macros | -| `include/util_varbuf.h` | Include header; annotate `ap_varbuf.buf` | -| `server/util.c` | Capacity-first assign in large-grow / init / free; comment on small-grow | -| `CMakeLists.txt` | `ENABLE_FBOUNDS_SAFETY` option OFF + apply flags when ON | -| `configure.in` | `--enable-fbounds-safety` (default no) | -| `NOTES.md` | This file | - -## Verified locally 2026-09-11 - -| Check | Result | -|-------|--------| -| Default `--enable-fbounds-safety` unset (OFF) `./configure` + `make -j` (httpd + modules) | **PASS** (gcc; `httpd` + `server/libmain.a`; configure printed `ENABLE_FBOUNDS_SAFETY disabled`) | -| `ENABLE_FBOUNDS_SAFETY=ON` / `--enable-fbounds-safety` | **Not feasible on this box** — needs Clang with `-fbounds-safety` / `ptrcheck.h` | - -## How to build / test - -Default (macros inert — must stay green): - -```sh -# Autotools (primary Unix path) -./buildconf -./configure --enable-fbounds-safety=no -make -j -# or CMake (primarily Windows / documented in README.cmake): -cmake -S . -B build -DENABLE_FBOUNDS_SAFETY=OFF -cmake --build build -j -``` - -With experimental bounds-safety toolchain (maintainers / CI; **not** available on this box — no Clang/`ptrcheck.h`): - -```sh -./configure --enable-fbounds-safety \ - CC= -make -j -# or: -cmake -S . -B build-fbs -DENABLE_FBOUNDS_SAFETY=ON \ - -DCMAKE_C_COMPILER= -cmake --build build-fbs -j -``` - -## Upstream submit plan - -1. Open a focused GitHub PR against `apache/httpd` branch **`trunk`** (or send to `dev@httpd.apache.org` per project preference / GitBox). -2. Proposed title: `varbuf: add optional -fbounds-safety annotations for struct ap_varbuf` -3. Frame as secure-by-design / Safe Buffers-style systematization of the existing buf+avail pair; cite libwebp/libpng/lz4/zstd/libzip prior art and Google Patch Rewards memory-safety goals. -4. Emphasize: default build behavior unchanged; flag OFF; no PoC / no CVE claim; public layout field order unchanged; no MMN bump. -5. Do **not** claim on https://bughunters.google.com/report/patch_rewards until **merge + ≥30 days**. - -## Follow-ups (separate CLs) - -- Other core buffer+size pairs on request/config paths as diagnostics under a real `-fbounds-safety` build dictate -- Module-local growable buffers that mirror `ap_varbuf` patterns -- APR brigade / bucket data pointers where a stable capacity companion exists (coordinate with APR) - -## AI gate - -- **No `CONTRIBUTING.md`** in upstream tree. -- Searched README, SECURITY.md, STATUS, ABOUT_APACHE, `.github/workflows/` — **no AI / LLM / Copilot ban**. -- **AI gate: CLEAR** (no ban found). - -## Overlap check - -- In-tree: no `__sized_by` / `-fbounds-safety` / `ptrcheck.h` references. -- GitHub `apache/httpd` search (fbounds / sized_by / counted_by / bounds-safety): **0** issues/PRs (2026-09-11). -- **PARK ON OVERLAP:** if an overlapping annotation PR appears before submit, do not race — coordinate or defer. - -## Status - -**LOCAL DRAFT ONLY** — commit on `local/varbuf-fbounds-safety`. Do **not** push/PR from this agent run. Still **no claim** until merge + ≥30 days unreverted.