mirrors/haproxy
1
0
Fork 0
mirror of https://git.haproxy.org/git/haproxy.git/ synced 2026-05-04 04:31:49 +02:00
Code Issues Projects Releases Wiki Activity

BUG/MINOR: net_helper: fix incomplete decoding in sample_conv_eth_vlan

Browse Source 
sample_conv_eth_vlan() reads the VLAN TCI at area[idx + 2] without
ensuring there are enough bytes. The original condition 'idx + 4 < data'
breaks when there IS room for more data, leading to an incomplete read
when trying to decode a VLAN ID.

This can be backported where this converter was backported.
This commit is contained in:
Willy Tarreau 2026-04-29 09:36:03 +02:00
parent afa32223b1
commit 80ca27be42
1 changed files with 1 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
src/net_helper.c
View File

@ -110,9 +110,8 @@ static int sample_conv_eth_vlan(const struct arg *arg_p, struct sample *smp, voi
smp->flags &= ~SMP_F_CONST;
return !!vlan;
}
if (idx + 4 < smp->data.u.str.data)
if (idx + 4 > smp->data.u.str.data)
break;
vlan = read_n16(smp->data.u.str.area + idx + 2) & 0xfff;
}
/* incomplete header */