From 48afa73af81876f064d02d01ec6ad1a9da34adcb Mon Sep 17 00:00:00 2001 From: Christopher Faulet Date: Fri, 24 Apr 2026 10:21:45 +0200 Subject: [PATCH] BUG/MAJOR: http-htx: Store new host in a chunk for scheme-based normalization During the scheme based normalization, The original authority value is used to replace every host headers. It is an issue, because when the HTX message is modified the blocks may be reorganised to find free space. For instance a defragmentation can be performed. So the address of the authority can change. To perform such rewrite, the new value must be stored in a temporary buffer. It is especially important because the start-line is also updated, so the original authority could be moved, making it invalid. Because of this bug, it is possible to mix HTX block values. There is no overflow but the start-line can be crushed with data from the host header value, making it invalid for the server. So, to fix the issue, the new host header value is now the one in the trash chunk used to rewrite the start line. But in that case, the trash chunk must be allocated to be sure it remains valid when replacing all host headers values. This patch must be backported as far as 2.6. --- src/http_htx.c | 13 ++++++++++--- 1 file changed, 10 insertions(+), 3 deletions(-) diff --git a/src/http_htx.c b/src/http_htx.c index 71c63e041..c80356364 100644 --- a/src/http_htx.c +++ b/src/http_htx.c @@ -1864,7 +1864,7 @@ int http_scheme_based_normalize(struct htx *htx) if (normalize) { /* reconstruct the uri with removal of the port */ - struct buffer *temp = get_trash_chunk(); + struct buffer *temp = alloc_trash_chunk(); struct ist meth, vsn; /* meth */ @@ -1879,16 +1879,23 @@ int http_scheme_based_normalize(struct htx *htx) chunk_memcat(temp, uri.ptr, authority.ptr - uri.ptr); chunk_istcat(temp, host); chunk_istcat(temp, path); - uri = ist2(temp->area + meth.len + vsn.len, host.len + path.len + authority.ptr - uri.ptr); /* uri */ + + /* update host and uri to point on temp chunk*/ + host = ist2(temp->area + meth.len + vsn.len + (authority.ptr - uri.ptr), host.len); + uri = ist2(temp->area + meth.len + vsn.len, host.len + path.len + authority.ptr - uri.ptr); + http_replace_stline(htx, meth, uri, vsn); /* replace every host headers values by the normalized host */ ctx.blk = NULL; while (http_find_header(htx, ist("host"), &ctx, 0)) { - if (!http_replace_header_value(htx, &ctx, host)) + if (!http_replace_header_value(htx, &ctx, host)) { + free_trash_chunk(temp); goto fail; + } } + free_trash_chunk(temp); } return 0;