Crash in header_rewrite plugin with LAST-CAPTURE on long paths

[mirakae]

Apache Traffic Server 10.1.0 crashes with std::out_of_range exception when the header_rewrite plugin uses %{LAST-CAPTURE} to extract regex capture groups from paths where the match occurs at character position > ~140.

Error Message

terminate called after throwing an instance of 'std::out_of_range'
  what():  basic_string_view::substr: __pos (which is 147) > __size (which is 6)
traffic_server: received signal 6 (Aborted)

header_rewrite.conf:

cond %{CLIENT-URL:PATH} /\/(test)\//
set-header X-Captured "%{LAST-CAPTURE:1}"

remap.config:

map https://example.com/ https://example.com @plugin=header_rewrite.so @pparam=header_rewrite.conf

test curl:
curl -v "https://example.com/session~v1_token~abc123def456_data~long-identifier-with-multiple-segments-and-parameters_key~xyz789_meta~additional-metadata-string/test/12345/quality/stream/master.m3u8"

Debug Log

[Dec 19 14:48:05.730] [ET_NET 77] DIAG: <HttpSM.cc:4426 (do_remap_request)> (http_seq) [0] Remapping request
[Dec 19 14:48:05.730] [ET_NET 77] DIAG: <resources.cc:31 (gather)> (header_rewrite) Building resources, hook=TS_HTTP_LAST_HOOK
[Dec 19 14:48:05.730] [ET_NET 77] DIAG: <resources.cc:39 (gather)> (header_rewrite)     Adding TXN client request header buffers
[Dec 19 14:48:05.730] [ET_NET 77] DIAG: <resources.cc:101 (gather)> (header_rewrite)    Adding TXN client request header buffers for remap instance
[Dec 19 14:48:05.730] [ET_NET 77] DIAG: <conditions.h:733 (eval)> (header_rewrite) Evaluating GROUP()
[Dec 19 14:48:05.730] [ET_NET 77] DIAG: <conditions.cc:282 (append_value)> (header_rewrite)    Using the pristine url
[Dec 19 14:48:05.730] [ET_NET 77] DIAG: <conditions.cc:334 (append_value)> (header_rewrite)    Path to match is: session~v1_token~abc123def456_data~long-identifier-with-multiple-segments-and-parameters_key~xyz789_meta~additional-metadata-string/test/12345/quality/stream/master.m3u8
[Dec 19 14:48:05.730] [ET_NET 77] DIAG: <matcher.h:194 (test_reg)> (header_rewrite) Test regular expression \/(test)\/ : session~v1_token~abc123def456_data~long-identifier-with-multiple-segments-and-parameters_key~xyz789_meta~additional-metadata-string/test/12345/quality/stream/master.m3u8 (NOCASE = 0)
[Dec 19 14:48:05.730] [ET_NET 77] DIAG: <matcher.h:198 (test_reg)> (header_rewrite) Successfully found regular expression match
terminate called after throwing an instance of 'std::out_of_range'
  what():  basic_string_view::substr: __pos (which is 147) > __size (which is 6)
[Dec 19 14:48:05.756] traffic_crashlo NOTE: crashlog started, target=28518, debug=false syslog=true, uid=999 euid=999
[Dec 19 14:48:05.757] traffic_crashlo NOTE: logging to 0x61917bb12be0
[Dec 19 14:48:05.757] traffic_crashlo NOTE: readlink failed with Permission denied
[Dec 19 14:48:05.758] traffic_crashlo ERROR: wrote crash log to /opt/trafficserver/var/log/trafficserver/crash-2025-12-19-144805.log
traffic_server: received signal 6 (Aborted)


is a specific config that need to be done on regex logic?

[bryancall]

#12117 is the PR that added this feature

[zwoop]

This seems to be fixed on master already. @cmcfarlen is looking at what needs to be back ported to 10.1.x. Thanks for the report!