mirrors/haproxy
1
0
Fork 0
mirror of https://git.haproxy.org/git/haproxy.git/ synced 2026-05-05 04:56:10 +02:00
Code Issues Projects Releases Wiki Activity

BUG/MEDIUM: filters: Handle filters registered on data with no payload callback

Browse Source 
An HTTP filter with no http_payload callback function may be registered on
data. In that case, this filter is obviously not called when some data are
received but it remains important to update its internal state to be sure to
keep it synchronized on the stream, especially its offet value. Otherwise,
the wrong calculation on the global offset may be performed in
flt_http_end(), leading to an integer overflow when data are moved from
input to output. This overflow triggers a BUG_ON() in c_adv().

The same is true for TCP filters with no tcp_payload callback function.

This patch must be backport to all stable versions.
This commit is contained in:
Christopher Faulet 2025-02-17 15:54:49 +01:00
parent 49b7bcf583
commit 34542d5ec2
1 changed files with 20 additions and 25 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

45
src/filters.c
View File

@ -700,23 +700,21 @@ flt_http_payload(struct stream *s, struct http_msg *msg, unsigned int len)
/* Call http_payload for filters only. Forward all data for
* others and update the filter offset
*/
if (!IS_DATA_FILTER(filter, msg->chn)) {
if (!IS_DATA_FILTER(filter, msg->chn) || !FLT_OPS(filter)->http_payload) {
*flt_off += data - offset;
continue;
}
if (FLT_OPS(filter)->http_payload) {
DBG_TRACE_DEVEL(FLT_ID(filter), STRM_EV_HTTP_ANA|STRM_EV_FLT_ANA, s);
filter->calls++;
ret = FLT_OPS(filter)->http_payload(s, filter, msg, out + offset, data - offset);
if (ret < 0) {
s->last_entity.type = STRM_ENTITY_FILTER;
s->last_entity.ptr = filter;
goto end;
}
data = ret + *flt_off - *strm_off;
*flt_off += ret;
DBG_TRACE_DEVEL(FLT_ID(filter), STRM_EV_HTTP_ANA|STRM_EV_FLT_ANA, s);
filter->calls++;
ret = FLT_OPS(filter)->http_payload(s, filter, msg, out + offset, data - offset);
if (ret < 0) {
s->last_entity.type = STRM_ENTITY_FILTER;
s->last_entity.ptr = filter;
goto end;
}
data = ret + *flt_off - *strm_off;
*flt_off += ret;
}
/* If nothing was forwarded yet, we take care to hold the headers if
@ -998,24 +996,21 @@ flt_tcp_payload(struct stream *s, struct channel *chn, unsigned int len)
/* Call tcp_payload for filters only. Forward all data for
* others and update the filter offset
*/
if (!IS_DATA_FILTER(filter, chn)) {
if (!IS_DATA_FILTER(filter, chn) || !FLT_OPS(filter)->tcp_payload) {
*flt_off += data - offset;
continue;
}
if (FLT_OPS(filter)->tcp_payload) {
DBG_TRACE_DEVEL(FLT_ID(filter), STRM_EV_TCP_ANA|STRM_EV_FLT_ANA, s);
filter->calls++;
ret = FLT_OPS(filter)->tcp_payload(s, filter, chn, out + offset, data - offset);
if (ret < 0) {
s->last_entity.type = STRM_ENTITY_FILTER;
s->last_entity.ptr = filter;
goto end;
}
data = ret + *flt_off - *strm_off;
*flt_off += ret;
DBG_TRACE_DEVEL(FLT_ID(filter), STRM_EV_TCP_ANA|STRM_EV_FLT_ANA, s);
filter->calls++;
ret = FLT_OPS(filter)->tcp_payload(s, filter, chn, out + offset, data - offset);
if (ret < 0) {
s->last_entity.type = STRM_ENTITY_FILTER;
s->last_entity.ptr = filter;
goto end;
}
data = ret + *flt_off - *strm_off;
*flt_off += ret;
}
/* Only forward data if the last filter decides to forward something */