RepoMirrors/haproxy
1
0
Fork 0
mirror of http://git.haproxy.org/git/haproxy.git/ synced 2025-01-05 03:29:35 +00:00
Code Issues Packages Projects Releases Wiki Activity

BUG/MAJOR: buf: Fix copy of wrapping output data when a buffer is realigned

Browse Source 
There is a bug in b_slow_realign() function when wrapping output data are
copied in the swap buffer. block1 and block2 sizes are inverted. Thus blocks
with a wrong size are copied. It leads to data mixin if the first block is
in reality larger than the second one or to a copy of data outside the
buffer is the first block is smaller than the second one.

The bug was introduced when the buffer API was refactored in 1.9. It was
found by a code review and seems never to have been triggered in almost 5
years. However, we cannot exclude it is responsible of some unresolved bugs.

This patch should fix issue #1978. It must be backported as far as 2.0.
This commit is contained in:
Christopher Faulet 2023-01-05 09:34:47 +01:00
parent 31850b470a
commit 61aded057d
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
include/haproxy/buf.h
View File

@ -467,7 +467,7 @@ static inline void b_slow_realign(struct buffer *b, char *swap, size_t output)
/* process output data in two steps to cover wrapping */
if (block1 > b_size(b) - b_head_ofs(b)) {
block2 = b_size(b) - b_head_ofs(b);
block2 = b_peek_ofs(b, block1);
block1 -= block2;
}
memcpy(swap + b_size(b) - output, b_head(b), block1);