RepoMirrors/haproxy
1
0
Fork 0
mirror of http://git.haproxy.org/git/haproxy.git/ synced 2024-12-13 06:54:37 +00:00
Code Issues Packages Projects Releases Wiki Activity

BUG/MEDIUM: 51d: possible incorrect operations on smp->data.str.str

Browse Source 
In src/51d.c, the function _51d_conv(), a final '\0' is added into
smp->data.str.str, which can cause a problem if the SMP_F_CONST flag is
set in smp->flags or if smp->data.str.size is not available.

This patch adds a check on smp->flags and smp->data.str.size, and copies
the smp->data.str.str to another buffer by using smp_dup(). If necessary,
the "const" flag is set after device detection. Also, this patch removes
the unnecessary call to chunk_reset() on temp argument.
This commit is contained in:
Dragan Dosen 2015-07-07 16:10:43 +02:00 committed by Willy Tarreau
parent 2fbcafc9ce
commit 96a0be78ed
1 changed files with 8 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
src/51d.c
View File

@ -127,6 +127,7 @@ static int _51d_conv(const struct arg *args, struct sample *smp, void *private)
lru = lru64_get(XXH64(smp->data.str.str, smp->data.str.len, seed), lru = lru64_get(XXH64(smp->data.str.str, smp->data.str.len, seed),
_51d_lru_tree, global._51degrees.data_file_path, 0); _51d_lru_tree, global._51degrees.data_file_path, 0);
if (lru && lru->domain) { if (lru && lru->domain) {
smp->flags |= SMP_F_CONST;
smp->data.str.str = lru->data; smp->data.str.str = lru->data;
smp->data.str.len = strlen(smp->data.str.str); smp->data.str.len = strlen(smp->data.str.str);
return 1; return 1;
@ -140,6 +141,10 @@ static int _51d_conv(const struct arg *args, struct sample *smp, void *private)
return 0; return 0;
#endif #endif
/* Duplicate the data and remove the "const" flag before device detection. */
if (!smp_dup(smp))
return 0;
smp->data.str.str[smp->data.str.len] = '\0'; smp->data.str.str[smp->data.str.len] = '\0';
/* Perform detection. */ /* Perform detection. */
@ -152,7 +157,6 @@ static int _51d_conv(const struct arg *args, struct sample *smp, void *private)
i = 0; i = 0;
temp = get_trash_chunk(); temp = get_trash_chunk();
chunk_reset(temp);
/* Loop through property names passed to the filter and fetch them from the dataset. */ /* Loop through property names passed to the filter and fetch them from the dataset. */
while (args[i].data.str.str) { while (args[i].data.str.str) {
@ -198,8 +202,10 @@ static int _51d_conv(const struct arg *args, struct sample *smp, void *private)
fiftyoneDegreesFreeWorkset(ws); fiftyoneDegreesFreeWorkset(ws);
#endif #endif
if (lru) if (lru) {
smp->flags |= SMP_F_CONST;
lru64_commit(lru, strdup(smp->data.str.str), global._51degrees.data_file_path, 0, free); lru64_commit(lru, strdup(smp->data.str.str), global._51degrees.data_file_path, 0, free);
}
return 1; return 1;
} }