RepoMirrors/haproxy
1
0
Fork 0
mirror of http://git.haproxy.org/git/haproxy.git/ synced 2025-01-30 18:13:32 +00:00
Code Issues Packages Projects Releases Wiki Activity

BUG/MEDIUM: capture: capture.{req,res}.* crash without a stream

Browse Source 
Since commit 5f940703b3 ("MINOR: log: Don't depends on a stream to process
samples in log-format string") it has become quite obvious that a few sample
fetch functions and converters were still heavily dependent on the presence
of a stream without testing for it.

The capture.req.hdr, capture.res.hdr, capture.req.method, capture.req.uri,
capture.req.ver and capture.res.ver sample fetches used to assume the
presence of a stream, which is not necessarily the case (especially after
the commit above) and would crash haproxy if incorrectly used. Let's make
sure they check for this stream.

This fix adds a check for the stream's existence, and should be backported
to all stable versions up to 1.6.
This commit is contained in:
Willy Tarreau 2020-04-29 11:44:54 +02:00
parent 5575896ba1
commit 0898c2d2f2
1 changed files with 30 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

36
src/http_fetch.c
View File

@ -1328,12 +1328,16 @@ static int smp_fetch_http_auth_grp(const struct arg *args, struct sample *smp, c
*/
static int smp_fetch_capture_req_hdr(const struct arg *args, struct sample *smp, const char *kw, void *private)
{
struct proxy *fe = strm_fe(smp->strm);
struct proxy *fe;
int idx;
if (!args || args->type != ARGT_SINT)
return 0;
if (!smp->strm)
return 0;
fe = strm_fe(smp->strm);
idx = args->data.sint;
if (idx > (fe->nb_req_cap - 1) || smp->strm->req_cap == NULL || smp->strm->req_cap[idx] == NULL)
@ -1352,12 +1356,16 @@ static int smp_fetch_capture_req_hdr(const struct arg *args, struct sample *smp,
*/
static int smp_fetch_capture_res_hdr(const struct arg *args, struct sample *smp, const char *kw, void *private)
{
struct proxy *fe = strm_fe(smp->strm);
struct proxy *fe;
int idx;
if (!args || args->type != ARGT_SINT)
return 0;
if (!smp->strm)
return 0;
fe = strm_fe(smp->strm);
idx = args->data.sint;
if (idx > (fe->nb_rsp_cap - 1) || smp->strm->res_cap == NULL || smp->strm->res_cap[idx] == NULL)
@ -1375,9 +1383,13 @@ static int smp_fetch_capture_res_hdr(const struct arg *args, struct sample *smp,
static int smp_fetch_capture_req_method(const struct arg *args, struct sample *smp, const char *kw, void *private)
{
struct buffer *temp;
struct http_txn *txn = smp->strm->txn;
struct http_txn *txn;
char *ptr;
if (!smp->strm)
return 0;
txn = smp->strm->txn;
if (!txn || !txn->uri)
return 0;
@ -1400,10 +1412,14 @@ static int smp_fetch_capture_req_method(const struct arg *args, struct sample *s
/* Extracts the path in the HTTP request, the txn->uri should be filled before the call */
static int smp_fetch_capture_req_uri(const struct arg *args, struct sample *smp, const char *kw, void *private)
{
struct http_txn *txn = smp->strm->txn;
struct http_txn *txn;
struct ist path;
const char *ptr;
if (!smp->strm)
return 0;
txn = smp->strm->txn;
if (!txn || !txn->uri)
return 0;
@ -1438,8 +1454,12 @@ static int smp_fetch_capture_req_uri(const struct arg *args, struct sample *smp,
*/
static int smp_fetch_capture_req_ver(const struct arg *args, struct sample *smp, const char *kw, void *private)
{
struct http_txn *txn = smp->strm->txn;
struct http_txn *txn;
if (!smp->strm)
return 0;
txn = smp->strm->txn;
if (!txn || txn->req.msg_state >= HTTP_MSG_BODY)
return 0;
@ -1460,8 +1480,12 @@ static int smp_fetch_capture_req_ver(const struct arg *args, struct sample *smp,
*/
static int smp_fetch_capture_res_ver(const struct arg *args, struct sample *smp, const char *kw, void *private)
{
struct http_txn *txn = smp->strm->txn;
struct http_txn *txn;
if (!smp->strm)
return 0;
txn = smp->strm->txn;
if (!txn || txn->rsp.msg_state >= HTTP_MSG_BODY)
return 0;