mirrors/haproxy
1
0
Fork 0
mirror of https://git.haproxy.org/git/haproxy.git/ synced 2025-09-23 23:01:24 +02:00
Code Issues Projects Releases Wiki Activity

BUG/MEDIUM: h2: fix aggregated cookie length computation in HTX mode

Browse Source 
Cyril Bont reported a bug in the way the cookie length is computed
when aggregating multiple cookies : the first cookie name was counted
as part of the value length, causing random contents to be placed there,
possibly leading to bad requests.

No backport is needed.
This commit is contained in:
Willy Tarreau 2018-12-18 11:00:41 +01:00
parent cef5c8e2aa
commit 164e061066
1 changed files with 7 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
src/h2.c
View File

@ -537,29 +537,32 @@ int h2_make_htx_request(struct http_hdr *list, struct htx *htx, unsigned int *ms
uint32_t fs; // free space uint32_t fs; // free space
uint32_t bs; // block size uint32_t bs; // block size
uint32_t vl; // value len uint32_t vl; // value len
uint32_t tl; // total length
struct htx_blk *blk; struct htx_blk *blk;
blk = htx_add_header(htx, ist("cookie"), list[ck].v); blk = htx_add_header(htx, ist("cookie"), list[ck].v);
if (!blk) if (!blk)
goto fail; goto fail;
tl = list[ck].v.len;
fs = htx_free_data_space(htx); fs = htx_free_data_space(htx);
bs = htx_get_blksz(blk); bs = htx_get_blksz(blk);
/* for each extra cookie, we'll extend the cookie's value and /* for each extra cookie, we'll extend the cookie's value and
* insert "; " before the new value. * insert "; " before the new value.
*/ */
for ( ; (ck = list[ck].n.len) >= 0 ; ) { fs += tl; // first one is already counted
for (; (ck = list[ck].n.len) >= 0 ; ) {
vl = list[ck].v.len; vl = list[ck].v.len;
if (vl + 2 > fs) tl += vl + 2;
if (tl > fs)
goto fail; goto fail;
htx_set_blk_value_len(blk, bs + 2 + vl); htx_set_blk_value_len(blk, tl);
*(char *)(htx_get_blk_ptr(htx, blk) + bs + 0) = ';'; *(char *)(htx_get_blk_ptr(htx, blk) + bs + 0) = ';';
*(char *)(htx_get_blk_ptr(htx, blk) + bs + 1) = ' '; *(char *)(htx_get_blk_ptr(htx, blk) + bs + 1) = ' ';
memcpy(htx_get_blk_ptr(htx, blk) + bs + 2, list[ck].v.ptr, vl); memcpy(htx_get_blk_ptr(htx, blk) + bs + 2, list[ck].v.ptr, vl);
bs += vl + 2; bs += vl + 2;
fs -= vl + 2;
} }
} }