From b9028ee1e40b7ba8edda20730285c12870ebbf2b Mon Sep 17 00:00:00 2001 From: Willy Tarreau Date: Mon, 4 May 2026 17:08:22 +0200 Subject: [PATCH] BUG/MAJOR: net_helper: also fix tcp_options_list for OOB write loop The exact same issue that was fixed for ip.fp with commit dbf471f99a ("BUG/MAJOR: net_helper: ip.fp infinite loop on malformed tcp options") also exists for tcp_options_list: an option with a zero size will prevent the offset from making any progress and will loop forever. In this case, since we produce output, trash->data gets incremented on each loop and the byte at ofs is used to fill the memory there, quickly overflowing the area. The exact same fix as above was applied here again, including the uchar cast to make sure we don't go back-and-forth between two positions. Such TCP options are not valid and will not be reported by the TCP stack, however they can happen in case options are passed in headers by a first proxy, or are offered in a return directive fed from a query string as a means of providing a debugging tool for admins. Thanks to Omkhar Arasaratnam for reporting this issue. This fix must be backported to 3.2 where the commits above were backported. --- src/net_helper.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/net_helper.c b/src/net_helper.c index e71abd9b0..84e6b86d8 100644 --- a/src/net_helper.c +++ b/src/net_helper.c @@ -605,8 +605,8 @@ static int sample_conv_tcp_options_list(const struct arg *arg_p, struct sample * /* kind1 = NOP and is a single byte, others have a length field */ if (smp->data.u.str.area[ofs] == 1) ofs++; - else if (ofs + 1 < len) - ofs += smp->data.u.str.area[ofs + 1]; + else if (ofs + 1 < len && smp->data.u.str.area[ofs + 1]) + ofs += (uchar)smp->data.u.str.area[ofs + 1]; else break; }