RepoMirrors/haproxy
1
0
Fork 0
mirror of http://git.haproxy.org/git/haproxy.git/ synced 2025-03-25 04:17:42 +00:00
Code Issues Packages Projects Releases Wiki Activity

BUG: backend: balance hdr was broken since 1.5-dev11

Browse Source 
Alex Markham reported and diagnosed a bug appearing on 1.5-dev11,
causing a crash on x86_64 when header hashing is used. The cause is
a missing (int) cast causing a negative offset to appear positive
and the resulting pointer to go out of bounds.

The crash is not possible anymore since 1.5-dev12 because a second
bug caused the negative sign to disappear so the pointer is always
within range but always wrong, so balance hdr() never works anymore.

This fix restores the correct behaviour and ensures the sign is
correct.
This commit is contained in:
Willy Tarreau 2012-09-22 18:36:29 +02:00
parent 290e63aa87
commit ce39bfb7c4
2 changed files with 2 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
include/common/buffer.h
View File

@ -52,6 +52,7 @@ void buffer_bounce_realign(struct buffer *buf);
* pointer. It is written so that it is optimal when <ofs> is a const. It is
* written as a macro instead of an inline function so that the compiler knows
* when it can optimize out the sign test on <ofs> when passed an unsigned int.
* Note that callers MUST cast <ofs> to int if they expect negative values.
*/
#define b_ptr(b, ofs) \
({ \

2
src/backend.c
View File

@ -343,7 +343,7 @@ struct server *get_server_hh(struct session *s)
ctx.idx = 0;
/* if the message is chunked, we skip the chunk size, but use the value as len */
http_find_header2(px->hh_name, plen, b_ptr(&s->req->buf, s->req->buf.o), &txn->hdr_idx, &ctx);
http_find_header2(px->hh_name, plen, b_ptr(&s->req->buf, (int)-s->req->buf.o), &txn->hdr_idx, &ctx);
/* if the header is not found or empty, let's fallback to round robin */
if (!ctx.idx || !ctx.vlen)