mirrors/haproxy
1
0
Fork 0
mirror of https://git.haproxy.org/git/haproxy.git/ synced 2025-11-28 14:21:00 +01:00
Code Issues Projects Releases Wiki Activity

BUG/MEDIUM: proto_htx: Fix data size update if end of the cookie is removed

Browse Source 
When client-side or server-side cookies are parsed, if the end of the cookie
line is removed, the HTX message must be updated. The length of the HTX block is
decreased and the data size of the HTX message is modified accordingly. The
update of the HTX block was ok but the update of the HTX message was wrong,
leading to undefined behaviours during the data forwarding. One of possible
effect was a freeze of the connection and no data forward.

This patch must be backported in 1.9.
This commit is contained in:
Christopher Faulet 2019-02-12 14:29:57 +01:00
parent 8861e1c082
commit 6cdaf2ad9a
1 changed files with 3 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
src/proto_htx.c
View File

@ -4281,7 +4281,7 @@ static void htx_manage_client_side_cookies(struct stream *s, struct channel *req
if ((hdr_end - hdr_beg) != ctx.value.len) {
if (hdr_beg != hdr_end) {
htx_set_blk_value_len(ctx.blk, hdr_end - hdr_beg);
htx->data -= (hdr_end - ctx.value.ptr);
htx->data -= ctx.value.len - (hdr_end - hdr_beg);
}
else
http_remove_header(htx, &ctx);
@ -4460,9 +4460,9 @@ static void htx_manage_server_side_cookies(struct stream *s, struct channel *res
next += stripped_before;
hdr_end += stripped_before;
htx_set_blk_value_len(ctx.blk, hdr_end - hdr_beg);
htx->data -= ctx.value.len - (hdr_end - hdr_beg);
ctx.value.len = hdr_end - hdr_beg;
htx_set_blk_value_len(ctx.blk, ctx.value.len);
htx->data -= (hdr_end - ctx.value.ptr);
}
/* First, let's see if we want to capture this cookie. We check