Skip to content

fix: buffer overflow in multipart body proc #1689

fix: buffer overflow in multipart body proc

fix: buffer overflow in multipart body proc #1689

Triggered via pull request April 12, 2026 21:54
Status Success
Total duration 13m 42s
Artifacts

ci.yml

on: pull_request
Matrix: build-linux
Matrix: build-macos
Matrix: build-windows
Fit to window
Zoom out
Zoom in

Annotations

3 errors and 74 warnings
Linux (x64, clang, wo geoip)
clone of 'https://github.com/owasp-modsecurity/secrules-language-tests' into submodule path '/home/runner/work/ModSecurity/ModSecurity/test/test-cases/secrules-language-tests' failed
Linux (x64, clang, wo geoip)
unable to access 'https://github.com/owasp-modsecurity/secrules-language-tests/': Failed to connect to github.com port 443 after 132716 ms: Connection timed out
Linux (x64, clang, wo geoip)
unable to access 'https://github.com/owasp-modsecurity/ModSecurity/': Failed to connect to github.com port 443 after 134284 ms: Connection timed out
Linux (x32, gcc, wo curl)
‘__builtin___snprintf_chk’ output may be truncated before the last format character [-Wformat-truncation=]
Linux (x32, gcc, wo curl)
‘%x’ directive output may be truncated writing between 1 and 6 bytes into a region of size 4 [-Wformat-truncation=]
Linux (x32, gcc, wo libxml)
‘__builtin___snprintf_chk’ output may be truncated before the last format character [-Wformat-truncation=]
Linux (x32, gcc, wo libxml)
‘%x’ directive output may be truncated writing between 1 and 6 bytes into a region of size 4 [-Wformat-truncation=]
Linux (x32, gcc, wo lua)
‘__builtin___snprintf_chk’ output may be truncated before the last format character [-Wformat-truncation=]
Linux (x32, gcc, wo lua)
‘%x’ directive output may be truncated writing between 1 and 6 bytes into a region of size 4 [-Wformat-truncation=]
Linux (x32, gcc, with lmdb)
‘__builtin___snprintf_chk’ output may be truncated before the last format character [-Wformat-truncation=]
Linux (x32, gcc, with lmdb)
‘%x’ directive output may be truncated writing between 1 and 6 bytes into a region of size 4 [-Wformat-truncation=]
Linux (x32, gcc, with pcre)
‘__builtin___snprintf_chk’ output may be truncated before the last format character [-Wformat-truncation=]
Linux (x32, gcc, with pcre)
‘%x’ directive output may be truncated writing between 1 and 6 bytes into a region of size 4 [-Wformat-truncation=]
Linux (x32, gcc, wo maxmind)
‘__builtin___snprintf_chk’ output may be truncated before the last format character [-Wformat-truncation=]
Linux (x32, gcc, wo maxmind)
‘%x’ directive output may be truncated writing between 1 and 6 bytes into a region of size 4 [-Wformat-truncation=]
Linux (x32, gcc, with parser generation)
‘__builtin___snprintf_chk’ output may be truncated before the last format character [-Wformat-truncation=]
Linux (x32, gcc, with parser generation)
‘%x’ directive output may be truncated writing between 1 and 6 bytes into a region of size 4 [-Wformat-truncation=]
Windows (x64, wo libxml)
'initializing': conversion from '__int64' to 'int', possible loss of data [D:\a\ModSecurity\ModSecurity\build\win32\build\regression_tests.vcxproj]
Windows (x64, wo libxml)
] [D:\a\ModSecurity\ModSecurity\build\win32\build\regression_tests.vcxproj]
Windows (x64, wo libxml)
_Ty=int [D:\a\ModSecurity\ModSecurity\build\win32\build\regression_tests.vcxproj]
Windows (x64, wo libxml)
[ [D:\a\ModSecurity\ModSecurity\build\win32\build\regression_tests.vcxproj]
Windows (x64, wo libxml)
with [D:\a\ModSecurity\ModSecurity\build\win32\build\regression_tests.vcxproj]
Windows (x64, wo libxml)
'=': conversion from '__int64' to '_Ty', possible loss of data [D:\a\ModSecurity\ModSecurity\build\win32\build\regression_tests.vcxproj]
Windows (x64, wo libxml)
'fopen': This function or variable may be unsafe. Consider using fopen_s instead. To disable deprecation, use _CRT_SECURE_NO_WARNINGS. See online help for details. [C:\Users\runneradmin\.conan2\p\b\pocobc0bf761f2778\b\build\NetSSL_OpenSSL\NetSSL.vcxproj]
Windows (x64, wo libxml)
'argument': conversion from 'std::streamoff' to 'DWORD', possible loss of data [C:\Users\runneradmin\.conan2\p\b\pocobc0bf761f2778\b\build\Net\Net.vcxproj]
Windows (x64, wo libxml)
'strncpy': This function or variable may be unsafe. Consider using strncpy_s instead. To disable deprecation, use _CRT_SECURE_NO_WARNINGS. See online help for details. [C:\Users\runneradmin\.conan2\p\b\pocobc0bf761f2778\b\build\Data\PostgreSQL\DataPostgreSQL.vcxproj]
Windows (x64, wo libxml)
'=': conversion from 'Poco::Int64' to 'long', possible loss of data [C:\Users\runneradmin\.conan2\p\b\pocobc0bf761f2778\b\build\Data\PostgreSQL\DataPostgreSQL.vcxproj]
Windows (x64, wo lua)
'initializing': conversion from '__int64' to 'int', possible loss of data [D:\a\ModSecurity\ModSecurity\build\win32\build\regression_tests.vcxproj]
Windows (x64, wo lua)
] [D:\a\ModSecurity\ModSecurity\build\win32\build\regression_tests.vcxproj]
Windows (x64, wo lua)
_Ty=int [D:\a\ModSecurity\ModSecurity\build\win32\build\regression_tests.vcxproj]
Windows (x64, wo lua)
[ [D:\a\ModSecurity\ModSecurity\build\win32\build\regression_tests.vcxproj]
Windows (x64, wo lua)
with [D:\a\ModSecurity\ModSecurity\build\win32\build\regression_tests.vcxproj]
Windows (x64, wo lua)
'=': conversion from '__int64' to '_Ty', possible loss of data [D:\a\ModSecurity\ModSecurity\build\win32\build\regression_tests.vcxproj]
Windows (x64, wo lua)
'fopen': This function or variable may be unsafe. Consider using fopen_s instead. To disable deprecation, use _CRT_SECURE_NO_WARNINGS. See online help for details. [C:\Users\runneradmin\.conan2\p\b\poco45b882baa28f1\b\build\NetSSL_OpenSSL\NetSSL.vcxproj]
Windows (x64, wo lua)
'argument': conversion from 'std::streamoff' to 'DWORD', possible loss of data [C:\Users\runneradmin\.conan2\p\b\poco45b882baa28f1\b\build\Net\Net.vcxproj]
Windows (x64, wo lua)
'strncpy': This function or variable may be unsafe. Consider using strncpy_s instead. To disable deprecation, use _CRT_SECURE_NO_WARNINGS. See online help for details. [C:\Users\runneradmin\.conan2\p\b\poco45b882baa28f1\b\build\Data\PostgreSQL\DataPostgreSQL.vcxproj]
Windows (x64, wo lua)
'=': conversion from 'Poco::Int64' to 'long', possible loss of data [C:\Users\runneradmin\.conan2\p\b\poco45b882baa28f1\b\build\Data\PostgreSQL\DataPostgreSQL.vcxproj]
Windows (x64, wo maxmind)
'initializing': conversion from '__int64' to 'int', possible loss of data [D:\a\ModSecurity\ModSecurity\build\win32\build\regression_tests.vcxproj]
Windows (x64, wo maxmind)
] [D:\a\ModSecurity\ModSecurity\build\win32\build\regression_tests.vcxproj]
Windows (x64, wo maxmind)
_Ty=int [D:\a\ModSecurity\ModSecurity\build\win32\build\regression_tests.vcxproj]
Windows (x64, wo maxmind)
[ [D:\a\ModSecurity\ModSecurity\build\win32\build\regression_tests.vcxproj]
Windows (x64, wo maxmind)
with [D:\a\ModSecurity\ModSecurity\build\win32\build\regression_tests.vcxproj]
Windows (x64, wo maxmind)
'=': conversion from '__int64' to '_Ty', possible loss of data [D:\a\ModSecurity\ModSecurity\build\win32\build\regression_tests.vcxproj]
Windows (x64, wo maxmind)
'fopen': This function or variable may be unsafe. Consider using fopen_s instead. To disable deprecation, use _CRT_SECURE_NO_WARNINGS. See online help for details. [C:\Users\runneradmin\.conan2\p\b\pocobcb3908a256fb\b\build\NetSSL_OpenSSL\NetSSL.vcxproj]
Windows (x64, wo maxmind)
'argument': conversion from 'std::streamoff' to 'DWORD', possible loss of data [C:\Users\runneradmin\.conan2\p\b\pocobcb3908a256fb\b\build\Net\Net.vcxproj]
Windows (x64, wo maxmind)
'strncpy': This function or variable may be unsafe. Consider using strncpy_s instead. To disable deprecation, use _CRT_SECURE_NO_WARNINGS. See online help for details. [C:\Users\runneradmin\.conan2\p\b\pocobcb3908a256fb\b\build\Data\PostgreSQL\DataPostgreSQL.vcxproj]
Windows (x64, wo maxmind)
'=': conversion from 'Poco::Int64' to 'long', possible loss of data [C:\Users\runneradmin\.conan2\p\b\pocobcb3908a256fb\b\build\Data\PostgreSQL\DataPostgreSQL.vcxproj]
Windows (x64, full)
'initializing': conversion from '__int64' to 'int', possible loss of data [D:\a\ModSecurity\ModSecurity\build\win32\build\regression_tests.vcxproj]
Windows (x64, full)
] [D:\a\ModSecurity\ModSecurity\build\win32\build\regression_tests.vcxproj]
Windows (x64, full)
_Ty=int [D:\a\ModSecurity\ModSecurity\build\win32\build\regression_tests.vcxproj]
Windows (x64, full)
[ [D:\a\ModSecurity\ModSecurity\build\win32\build\regression_tests.vcxproj]
Windows (x64, full)
with [D:\a\ModSecurity\ModSecurity\build\win32\build\regression_tests.vcxproj]
Windows (x64, full)
'=': conversion from '__int64' to '_Ty', possible loss of data [D:\a\ModSecurity\ModSecurity\build\win32\build\regression_tests.vcxproj]
Windows (x64, full)
'fopen': This function or variable may be unsafe. Consider using fopen_s instead. To disable deprecation, use _CRT_SECURE_NO_WARNINGS. See online help for details. [C:\Users\runneradmin\.conan2\p\b\pococd7cfd8b8834d\b\build\NetSSL_OpenSSL\NetSSL.vcxproj]
Windows (x64, full)
'argument': conversion from 'std::streamoff' to 'DWORD', possible loss of data [C:\Users\runneradmin\.conan2\p\b\pococd7cfd8b8834d\b\build\Net\Net.vcxproj]
Windows (x64, full)
'strncpy': This function or variable may be unsafe. Consider using strncpy_s instead. To disable deprecation, use _CRT_SECURE_NO_WARNINGS. See online help for details. [C:\Users\runneradmin\.conan2\p\b\pococd7cfd8b8834d\b\build\Data\PostgreSQL\DataPostgreSQL.vcxproj]
Windows (x64, full)
'=': conversion from 'Poco::Int64' to 'long', possible loss of data [C:\Users\runneradmin\.conan2\p\b\pococd7cfd8b8834d\b\build\Data\PostgreSQL\DataPostgreSQL.vcxproj]
Windows (x64, with lmdb)
'initializing': conversion from '__int64' to 'int', possible loss of data [D:\a\ModSecurity\ModSecurity\build\win32\build\regression_tests.vcxproj]
Windows (x64, with lmdb)
] [D:\a\ModSecurity\ModSecurity\build\win32\build\regression_tests.vcxproj]
Windows (x64, with lmdb)
_Ty=int [D:\a\ModSecurity\ModSecurity\build\win32\build\regression_tests.vcxproj]
Windows (x64, with lmdb)
[ [D:\a\ModSecurity\ModSecurity\build\win32\build\regression_tests.vcxproj]
Windows (x64, with lmdb)
with [D:\a\ModSecurity\ModSecurity\build\win32\build\regression_tests.vcxproj]
Windows (x64, with lmdb)
'=': conversion from '__int64' to '_Ty', possible loss of data [D:\a\ModSecurity\ModSecurity\build\win32\build\regression_tests.vcxproj]
Windows (x64, with lmdb)
'fopen': This function or variable may be unsafe. Consider using fopen_s instead. To disable deprecation, use _CRT_SECURE_NO_WARNINGS. See online help for details. [C:\Users\runneradmin\.conan2\p\b\poco358039e860c3d\b\build\NetSSL_OpenSSL\NetSSL.vcxproj]
Windows (x64, with lmdb)
'argument': conversion from 'std::streamoff' to 'DWORD', possible loss of data [C:\Users\runneradmin\.conan2\p\b\poco358039e860c3d\b\build\Net\Net.vcxproj]
Windows (x64, with lmdb)
'strncpy': This function or variable may be unsafe. Consider using strncpy_s instead. To disable deprecation, use _CRT_SECURE_NO_WARNINGS. See online help for details. [C:\Users\runneradmin\.conan2\p\b\poco358039e860c3d\b\build\Data\PostgreSQL\DataPostgreSQL.vcxproj]
Windows (x64, with lmdb)
'=': conversion from 'Poco::Int64' to 'long', possible loss of data [C:\Users\runneradmin\.conan2\p\b\poco358039e860c3d\b\build\Data\PostgreSQL\DataPostgreSQL.vcxproj]
Windows (x64, wo curl)
'initializing': conversion from '__int64' to 'int', possible loss of data [D:\a\ModSecurity\ModSecurity\build\win32\build\regression_tests.vcxproj]
Windows (x64, wo curl)
] [D:\a\ModSecurity\ModSecurity\build\win32\build\regression_tests.vcxproj]
Windows (x64, wo curl)
_Ty=int [D:\a\ModSecurity\ModSecurity\build\win32\build\regression_tests.vcxproj]
Windows (x64, wo curl)
[ [D:\a\ModSecurity\ModSecurity\build\win32\build\regression_tests.vcxproj]
Windows (x64, wo curl)
with [D:\a\ModSecurity\ModSecurity\build\win32\build\regression_tests.vcxproj]
Windows (x64, wo curl)
'=': conversion from '__int64' to '_Ty', possible loss of data [D:\a\ModSecurity\ModSecurity\build\win32\build\regression_tests.vcxproj]
Windows (x64, wo curl)
'fopen': This function or variable may be unsafe. Consider using fopen_s instead. To disable deprecation, use _CRT_SECURE_NO_WARNINGS. See online help for details. [C:\Users\runneradmin\.conan2\p\b\pocob0a5a8b598cd1\b\build\NetSSL_OpenSSL\NetSSL.vcxproj]
Windows (x64, wo curl)
'argument': conversion from 'std::streamoff' to 'DWORD', possible loss of data [C:\Users\runneradmin\.conan2\p\b\pocob0a5a8b598cd1\b\build\Net\Net.vcxproj]
Windows (x64, wo curl)
'strncpy': This function or variable may be unsafe. Consider using strncpy_s instead. To disable deprecation, use _CRT_SECURE_NO_WARNINGS. See online help for details. [C:\Users\runneradmin\.conan2\p\b\pocob0a5a8b598cd1\b\build\Data\PostgreSQL\DataPostgreSQL.vcxproj]
Windows (x64, wo curl)
'=': conversion from 'Poco::Int64' to 'long', possible loss of data [C:\Users\runneradmin\.conan2\p\b\pocob0a5a8b598cd1\b\build\Data\PostgreSQL\DataPostgreSQL.vcxproj]