IIS: fix Content-Length formatting (correct printf specifier + full buffer size)

[A13501350]

Summary

Fixes the Content-Length header value being corrupted/truncated in the IIS module when ModSecurity has to synthesize it (only-response, non-chunked case).

Two defects were fixed in iis/mymodule.cpp:

• ulTotalLength is a ULONGLONG, but was printed with "%d" (32-bit int). printf only consumed the low 32 bits, producing a wrong header for response bodies larger than ~2 GiB. Now uses "%llu".
• The two other call sites format an unsigned int length with "%d"; changed to "%u".
• StringCchPrintfA's cchDest was passed as sizeof(szLength)/sizeof(CHAR) - 1 (20), which can only hold 19 digits + null and would truncate a 20-digit 64-bit value. Now passes the full buffer size (21, which includes the null terminator).

Fixes

Closes #3619

Changed locations

• iis/mymodule.cpp:644 — ulTotalLength (ULONGLONG) -> "%llu"
• iis/mymodule.cpp:1142 — length (unsigned int) -> "%u"
• iis/mymodule.cpp:1230 — length (unsigned int) -> "%u"

All three now pass sizeof(szLength) / sizeof(CHAR) as the destination size.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: fc82eb0f-5bf5-4611-b884-c50f9d1b27e5

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
3 Accepted issues

Measures
0 Security Hotspots
No data about Coverage
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[Copilot]

🟢 Approval recommended

No unresolved review comments remain, and the requested fixes are addressed.

Pull request overview

Fixes IIS Content-Length generation for large responses by correcting format specifiers and buffer sizing.

Changes:

• Uses %llu for ULONGLONG values.
• Uses %u for unsigned lengths.
• Passes the full destination buffer size.

File summaries

File	Description
iis/mymodule.cpp	Corrects all three Content-Length formatting call sites.

Review details

• Files reviewed: 1/1 changed files
• Comments generated: 0
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[airween]

Hi @A13501350,

thank you for this PR!

Could you check SonarCloud issues, and consider to change the suggestions?

[A13501350]

Hi @airween, thank you for the review. The warning is about legacy code, unrelated to this fix. I'd like to keep the change minimal; unless there's a large-scale refactoring in the future, fixing it now won't help.

[airween]

Hi @airween, thank you for the review. The warning is about legacy code, unrelated to this fix. I'd like to keep the change minimal; unless there's a large-scale refactoring in the future, fixing it now won't help.

Ah, sorry, now I see (I just saw the same commit hash on Sonar's page that you added on GH, but didn't realize you changed the other part in the line).

Sorry, I'll accept those issues.