From f69d4ff0063723442ba62af7ca582b1db163bd31 Mon Sep 17 00:00:00 2001 From: Willy Tarreau Date: Sat, 2 May 2015 00:05:47 +0200 Subject: [PATCH] BUG/MAJOR: http: prevent risk of reading past end with balance url_param The get_server_ph_post() function assumes that the buffer is contiguous. While this is true for all the header part, it is not necessarily true for the end of data the fit in the reserve. In this case there's a risk to read past the end of the buffer for a few hundred bytes, and possibly to crash the process if what follows is not mapped. The fix consists in truncating the analyzed length to the length of the contiguous block that follows the headers. A config workaround for this bug would be to disable balance url_param. This fix must be backported to 1.5. It seems 1.4 did have the check. --- src/backend.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/src/backend.c b/src/backend.c index 75792bde0d..17a55d6685 100644 --- a/src/backend.c +++ b/src/backend.c @@ -313,6 +313,9 @@ struct server *get_server_ph_post(struct stream *s) if (len == 0) return NULL; + if (len > req->buf->data + req->buf->size - p) + len = req->buf->data + req->buf->size - p; + if (px->lbprm.tot_weight == 0) return NULL;