haproxy/include
Willy Tarreau 320ec2a745 BUG/MEDIUM: chunks: always reject negative-length chunks
The recent addition of "show env" on the CLI has revealed an interesting
design bug. Chunks are supposed to support a negative length to indicate
that they carry no data. chunk_printf() sets this size to -1 if the string
is too large for the buffer. At a few places in the http engine we may end
up with trash.len = -1. But bi_putchk(), chunk_appendf() and a few other
chunks consumers don't consider this case as possible and will use such a
chunk, possibly restoring an invalid string or trying to copy -1 bytes.

This fix takes care of clarifying the situation in a backportable way
where such sizes are used, so that a negative length indicating an error
remains present until the chunk is reinitialized or overwritten. But a
cleaner design adjustment needs to be done so that there's a clear contract
on how to use these chunks. At first glance it doesn't seem *that* useful
to support negative sizes, so probably this is what should change.

This fix must be backported to 1.6 and 1.5.
2016-02-25 16:24:14 +01:00
..
common BUG/MEDIUM: chunks: always reject negative-length chunks 2016-02-25 16:24:14 +01:00
import MINOR: lru: new function to delete <nb> least recently used keys 2016-01-11 07:31:35 +01:00
proto MINOR: server: generalize the "updater" source 2016-02-24 23:37:39 +01:00
types MINOR: mailers: make it possible to configure the connection timeout 2016-02-20 15:33:06 +01:00