mirrors/haproxy
1
0
Fork 0
mirror of https://git.haproxy.org/git/haproxy.git/ synced 2025-09-22 22:31:28 +02:00
Code Issues Projects Releases Wiki Activity

BUG/MEDIUM: pattern: Add a trailing \0 to match strings only if possible

Browse Source 
In pat_match_str() and pat_math_beg() functions, a trailing zero is
systematically added at the end of the string, even if the buffer is not large
enough to accommodate it. It is a possible buffer overflow. For instance, when
the alpn is matched against a list of strings, the sample fetch is filled with a
non-null terminated string returned by the SSL library. No trailing zero must be
added at the end of this string, because it is outside the buffer.

So, to fix the bug, a trailing zero is added only if the buffer is large enough
to accommodate it. Otherwise, the sample fetch is duplicated. smp_dup() function
adds a trailing zero to the duplicated string, truncating it if it is too long.

This patch should fix the issue #718. It must be backported to all supported
versions.
This commit is contained in:
Christopher Faulet 2020-06-30 18:52:32 +02:00
parent 5d03639ba6
commit b4cf7ab9bc
1 changed files with 36 additions and 11 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

47
src/pattern.c
View File

@ -453,7 +453,6 @@ struct pattern *pat_match_str(struct sample *smp, struct pattern_expr *expr, int
{ {
int icase; int icase;
struct ebmb_node *node; struct ebmb_node *node;
char prev;
struct pattern_tree *elt; struct pattern_tree *elt;
struct pattern_list *lst; struct pattern_list *lst;
struct pattern *pattern; struct pattern *pattern;
@ -462,14 +461,27 @@ struct pattern *pat_match_str(struct sample *smp, struct pattern_expr *expr, int
/* Lookup a string in the expression's pattern tree. */ /* Lookup a string in the expression's pattern tree. */
if (!eb_is_empty(&expr->pattern_tree)) { if (!eb_is_empty(&expr->pattern_tree)) {
/* we may have to force a trailing zero on the test pattern */ char prev = 0;
prev = smp->data.u.str.area[smp->data.u.str.data];
if (prev) if (smp->data.u.str.data < smp->data.u.str.size) {
smp->data.u.str.area[smp->data.u.str.data] = '\0'; /* we may have to force a trailing zero on the test pattern and
* the buffer is large enough to accommodate it.
*/
prev = smp->data.u.str.area[smp->data.u.str.data];
if (prev)
smp->data.u.str.area[smp->data.u.str.data] = '\0';
}
else {
/* Otherwise, the sample is duplicated. A trailing zero
* is automatically added to the string.
*/
if (!smp_dup(smp))
return NULL;
}
node = ebst_lookup(&expr->pattern_tree, smp->data.u.str.area); node = ebst_lookup(&expr->pattern_tree, smp->data.u.str.area);
if (prev) if (prev)
smp->data.u.str.area[smp->data.u.str.data] = prev; smp->data.u.str.area[smp->data.u.str.data] = prev;
if (node) { if (node) {
if (fill) { if (fill) {
elt = ebmb_entry(node, struct pattern_tree, node); elt = ebmb_entry(node, struct pattern_tree, node);
@ -618,7 +630,6 @@ struct pattern *pat_match_beg(struct sample *smp, struct pattern_expr *expr, int
{ {
int icase; int icase;
struct ebmb_node *node; struct ebmb_node *node;
char prev;
struct pattern_tree *elt; struct pattern_tree *elt;
struct pattern_list *lst; struct pattern_list *lst;
struct pattern *pattern; struct pattern *pattern;
@ -627,10 +638,24 @@ struct pattern *pat_match_beg(struct sample *smp, struct pattern_expr *expr, int
/* Lookup a string in the expression's pattern tree. */ /* Lookup a string in the expression's pattern tree. */
if (!eb_is_empty(&expr->pattern_tree)) { if (!eb_is_empty(&expr->pattern_tree)) {
/* we may have to force a trailing zero on the test pattern */ char prev = 0;
prev = smp->data.u.str.area[smp->data.u.str.data];
if (prev) if (smp->data.u.str.data < smp->data.u.str.size) {
smp->data.u.str.area[smp->data.u.str.data] = '\0'; /* we may have to force a trailing zero on the test pattern and
* the buffer is large enough to accommodate it.
*/
prev = smp->data.u.str.area[smp->data.u.str.data];
if (prev)
smp->data.u.str.area[smp->data.u.str.data] = '\0';
}
else {
/* Otherwise, the sample is duplicated. A trailing zero
* is automatically added to the string.
*/
if (!smp_dup(smp))
return NULL;
}
node = ebmb_lookup_longest(&expr->pattern_tree, node = ebmb_lookup_longest(&expr->pattern_tree,
smp->data.u.str.area); smp->data.u.str.area);
if (prev) if (prev)