mirrors/haproxy
1
0
Fork 0
mirror of https://git.haproxy.org/git/haproxy.git/ synced 2026-05-05 04:56:10 +02:00
Code Issues Projects Releases Wiki Activity

BUG/MINOR: http_act: Properly handle decoding errors in *-headers-bin actions

Browse Source 
When binary headers are decoded, return value of decode_varint() function is
not properly handled. On error, it can return -1. However, the result is
inconditionnaly added to an unsigned offset.

Now, a temporary variable is used to be abl to test decode_varint() return
value. It is added to the offset on success only.

No backport needed.
This commit is contained in:
Christopher Faulet 2026-03-31 22:24:32 +02:00
parent ee95a7539e
commit 7c73b08a98
1 changed files with 19 additions and 10 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

29
src/http_act.c
View File

@ -1515,14 +1515,18 @@ static enum act_return http_action_set_headers_bin(struct act_rule *rule, struct
decoded->data = bytes_read;
while (1) {
offset += decode_varint(&decoded->area, decoded->area + decoded->data - offset, &sz);
if (offset == -1)
int ret;
ret = decode_varint(&decoded->area, decoded->area + decoded->data - offset, &sz);
if (ret == -1)
goto fail_rewrite;
offset += ret;
if (!sz) {
offset += decode_varint(&decoded->area, decoded->area + decoded->data - offset, &sz);
if (offset == -1)
ret = decode_varint(&decoded->area, decoded->area + decoded->data - offset, &sz);
if (ret == -1)
goto fail_rewrite;
offset += ret;
if (!sz)
goto leave;
else
@ -1533,9 +1537,10 @@ static enum act_return http_action_set_headers_bin(struct act_rule *rule, struct
offset += sz;
decoded->area += sz;
offset += decode_varint(&decoded->area, decoded->area + decoded->data - offset, &sz);
if (offset == -1)
ret = decode_varint(&decoded->area, decoded->area + decoded->data - offset, &sz);
if (ret == -1)
goto fail_rewrite;
offset += ret;
v = ist2(decoded->area, sz);
offset += sz;
@ -1977,14 +1982,18 @@ static enum act_return http_action_del_headers_bin(struct act_rule *rule, struct
decoded->data = bytes_read;
while (1) {
offset += decode_varint(&decoded->area, decoded->area + decoded->data - offset, &sz);
if (offset == -1)
int ret;
ret = decode_varint(&decoded->area, decoded->area + decoded->data - offset, &sz);
if (ret == -1)
goto fail_rewrite;
offset += ret;
if (!sz) {
offset += decode_varint(&decoded->area, decoded->area + decoded->data - offset, &sz);
if (offset == -1)
ret = decode_varint(&decoded->area, decoded->area + decoded->data - offset, &sz);
if (ret == -1)
goto fail_rewrite;
offset += ret;
if (!sz)
goto leave;
else