RepoMirrors/haproxy
1
0
Fork 0
mirror of http://git.haproxy.org/git/haproxy.git/ synced 2024-12-14 23:44:41 +00:00
Code Issues Packages Projects Releases Wiki Activity

BUG/MEDIUM: http: Prevent replace-header from overwriting a buffer

Browse Source 
This is the same fix as which concerning the redirect rules (0d94576c).

The buffer used to expand the <replace-fmt> argument must be protected to
prevent it being overwritten during build_logline() execution (the function used
to expand the format string).

This patch should be backported in 1.7, 1.6 and 1.5. It relies on commit b686afd
("MINOR: chunks: implement a simple dynamic allocator for trash buffers") for
the trash allocator, which has to be backported as well.
This commit is contained in:
Christopher Faulet 2017-02-08 12:17:07 +01:00 committed by Willy Tarreau
parent f1cc5d0eaf
commit 07a0fecced
1 changed files with 12 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

15
src/proto_http.c
View File

@ -3419,13 +3419,22 @@ static int http_transform_header(struct stream* s, struct http_msg *msg,
struct list *fmt, struct my_regex *re,
int action)
{
struct chunk *replace = get_trash_chunk();
struct chunk *replace;
int ret = -1;
replace = alloc_trash_chunk();
if (!replace)
goto leave;
replace->len = build_logline(s, replace->str, replace->size, fmt);
if (replace->len >= replace->size - 1)
return -1;
goto leave;
return http_transform_header_str(s, msg, name, name_len, replace->str, re, action);
ret = http_transform_header_str(s, msg, name, name_len, replace->str, re, action);
leave:
free_trash_chunk(replace);
return ret;
}
/* Executes the http-request rules <rules> for stream <s>, proxy <px> and