mirrors/haproxy
1
0
Fork 0
mirror of https://git.haproxy.org/git/haproxy.git/ synced 2025-09-21 22:01:31 +02:00
Code Issues Projects Releases Wiki Activity

[BUG] http: correctly update the header list when removing two consecutive headers

Browse Source 
When a header is removed, the previous header's next pointer is updated
to reflect the next of the current header. However, when cycling through
the loop, we update the prev pointer to point to the deleted header, which
means that if we delete another header, it's the deleted header's next
pointer that will be updated, leaving the deleted header in the list with
a null length, which is forbidden.

We must just not update the prev pointer after a removal.

This bug was present when either "reqdel" and "rspdel" removed two consecutive
headers. It could also occur when removing cookies in either requests or
responses, but since headers were the last header processing, the issue
remained unnoticed.

Issue reported by Hank A. Paulson.

This fix must be ported to 1.4 and possibly 1.3.
This commit is contained in:
Willy Tarreau 2010-11-28 06:57:24 +01:00
parent b810554f8f
commit 26db59ea6b
1 changed files with 4 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
src/proto_http.c
View File

@ -5553,6 +5553,7 @@ int apply_filter_to_req_headers(struct session *t, struct buffer *req, struct hd
txn->hdr_idx.used--;
cur_hdr->len = 0;
cur_end = NULL; /* null-term has been rewritten */
cur_idx = old_idx;
break;
}
@ -6325,6 +6326,7 @@ void manage_client_side_cookies(struct session *t, struct buffer *req)
txn->hdr_idx.v[old_idx].next = cur_hdr->next;
txn->hdr_idx.used--;
cur_hdr->len = 0;
cur_idx = old_idx;
}
hdr_next += delta;
http_msg_move_end(&txn->req, delta);
@ -6417,6 +6419,7 @@ int apply_filter_to_resp_headers(struct session *t, struct buffer *rtr, struct h
txn->hdr_idx.used--;
cur_hdr->len = 0;
cur_end = NULL; /* null-term has been rewritten */
cur_idx = old_idx;
break;
}
@ -6806,6 +6809,7 @@ void manage_server_side_cookies(struct session *t, struct buffer *res)
txn->hdr_idx.v[old_idx].next = cur_hdr->next;
txn->hdr_idx.used--;
cur_hdr->len = 0;
cur_idx = old_idx;
hdr_next += delta;
http_msg_move_end(&txn->rsp, delta);
/* note: while both invalid now, <next> and <hdr_end>