mirrors/haproxy
1
0
Fork 0
mirror of https://git.haproxy.org/git/haproxy.git/ synced 2025-08-07 15:47:01 +02:00
Code Issues Projects Releases Wiki Activity

BUG/MAJOR: Fix crash in http_get_fhdr with exactly MAX_HDR_HISTORY headers

Browse Source 
Similar issue was fixed in 67dad27, but the fix is incomplete. Crash still
happened when utilizing req.fhdr() and sending exactly MAX_HDR_HISTORY
headers.

This fix needs to be backported to 1.5 and 1.6.

Signed-off-by: Nenad Merdanovic <nmerdan@anine.io>
This commit is contained in:
Nenad Merdanovic 2016-03-29 13:14:30 +02:00 committed by Willy Tarreau
parent 1789115a52
commit 69ad4b9977
1 changed files with 5 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
src/proto_http.c
View File

@ -8537,10 +8537,13 @@ unsigned int http_get_fhdr(const struct http_msg *msg, const char *hname, int hl
}
if (-occ > found)
return 0;
/* OK now we have the last occurrence in [hist_ptr-1], and we need to
* find occurrence -occ, so we have to check [hist_ptr+occ].
* find occurrence -occ. 0 <= hist_ptr < MAX_HDR_HISTORY, and we have
* -10 <= occ <= -1. So we have to check [hist_ptr%MAX_HDR_HISTORY+occ]
* to remain in the 0..9 range.
*/
hist_ptr += occ;
hist_ptr += occ + MAX_HDR_HISTORY;
if (hist_ptr >= MAX_HDR_HISTORY)
hist_ptr -= MAX_HDR_HISTORY;
*vptr = ptr_hist[hist_ptr];