mirrors/haproxy
1
0
Fork 0
mirror of https://git.haproxy.org/git/haproxy.git/ synced 2025-08-06 23:27:04 +02:00
Code Issues Projects Releases Wiki Activity

BUG/MAJOR: http-ana: Get a fresh trash buffer for each header value replacement

Browse Source 
When a "replace-header" action is used, we loop on all headers in the
message to change value of all headers matching a name. The new value is
placed in a trash. However, there is a race here because if the message must
be defragmented, another trash is used. If several defragmentation are
performed because several headers must be updated at same time, the first
trash, used to store the new value, may be crushed. Indeed, there are only 2
pre-allocated trash used in rotation. and the trash to store the new value
is never renewed. As consequece, random data may be inserted into the header
value.

Here, to fix the issue, we must take care to refresh the trash buffer when
we evaluated a new header. This way, a trash used for the new value, and
eventually another way for the htx defragmentation. But that's all.

Thanks to Christian Ruppert for his detailed report.

This patch must be to all stable versions. On the 2.0, the patch must be
applied on src/proto_htx.c and the function is named
htx_transform_header_str().
This commit is contained in:
Christopher Faulet 2023-08-04 16:51:11 +02:00
parent 559482c11e
commit 624979cf3b
1 changed files with 2 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
src/http_ana.c
View File

@ -2522,10 +2522,11 @@ int http_replace_hdrs(struct stream* s, struct htx *htx, struct ist name,
const char *str, struct my_regex *re, int full)
{
struct http_hdr_ctx ctx;
struct buffer *output = get_trash_chunk();
ctx.blk = NULL;
while (http_find_header(htx, name, &ctx, full)) {
struct buffer *output = get_trash_chunk();
if (!regex_exec_match2(re, ctx.value.ptr, ctx.value.len, MAX_MATCH, pmatch, 0))
continue;