[CRITICAL] an empty header may lead to a crash

A missing pointer assignment in case of an empty header
will result in this header's length being 65535, causing
a SEGV when accessing the next header. It should not be
possible to exploit this problem to run arbitrary code
because the crash occurs while reading the data.
This commit is contained in:
Willy Tarreau 2007-01-26 23:39:38 +01:00
parent f0d058e8ab
commit b9ebf70a3a

View File

@ -1018,6 +1018,7 @@ void http_msg_analyzer(struct buffer *buf, struct http_msg *msg, struct hdr_idx
buf->data[msg->sov] = ' ';
goto http_msg_hdr_l1_sp;
}
msg->eol = ptr;
goto http_msg_complete_header;
http_msg_hdr_val: