1 files changed, 2 insertions, 0 deletions
diff --git a/server/util.c b/server/util.c
index 10d3e35b20..7fda13cc66 100644
--- a/server/util.c
+++ b/server/util.c
@@ -411,6 +411,8 @@ static apr_status_t regsub_core(apr_pool_t *p, char **result,
             len++;
         }
         else if (no < nmatch && pmatch[no].rm_so < pmatch[no].rm_eo) {
+            if (APR_SIZE_MAX - len <= pmatch[no].rm_eo - pmatch[no].rm_so)
+                return APR_ENOMEM;
             len += pmatch[no].rm_eo - pmatch[no].rm_so;
         }