mirrors/haproxy
1
0
Fork 0
mirror of https://git.haproxy.org/git/haproxy.git/ synced 2026-05-04 20:46:11 +02:00
Code Issues Projects Releases Wiki Activity

BUG/MINOR: http_fetch: fix possible uninit sockaddr in fetch_url_ip/port

Browse Source 
Check the return value of url2sa in smp_fetch_url_ip/port. If negative,
the address result is uninitialized and the sample fetch is aborted.
Also, the sockaddr is prelimiary zero'ed before calling url2sa to ensure
that it is not used by upper functions even if the sample returns 0.

Without the check, the value returned by the url_ip/url_port fetches is
unspecified. This can be triggered with the following curl :
$ curl -iv --request-target "xxx://127.0.0.1:20080/" http://127.0.0.1:20080/

This should be backported to all stable branches. However, note that
between the 1.8 and 2.0, the targetted functions have been extracted
from proto_http.c to http_fetch.c.

This should fix in part coverity report from the github issue #1244.
This commit is contained in:
Amaury Denoyelle 2021-05-10 11:23:34 +02:00
parent 46b93afdb3
commit c89d5337ee
1 changed files with 8 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
src/http_fetch.c
View File

@ -705,10 +705,13 @@ static int smp_fetch_url_ip(const struct arg *args, struct sample *smp, const ch
struct htx_sl *sl;
struct sockaddr_storage addr;
memset(&addr, 0, sizeof(addr));
if (!htx)
return 0;
sl = http_get_stline(htx);
url2sa(HTX_SL_REQ_UPTR(sl), HTX_SL_REQ_ULEN(sl), &addr, NULL);
if (url2sa(HTX_SL_REQ_UPTR(sl), HTX_SL_REQ_ULEN(sl), &addr, NULL) < 0)
return 0;
if (addr.ss_family != AF_INET)
return 0;
@ -726,10 +729,13 @@ static int smp_fetch_url_port(const struct arg *args, struct sample *smp, const
struct htx_sl *sl;
struct sockaddr_storage addr;
memset(&addr, 0, sizeof(addr));
if (!htx)
return 0;
sl = http_get_stline(htx);
url2sa(HTX_SL_REQ_UPTR(sl), HTX_SL_REQ_ULEN(sl), &addr, NULL);
if (url2sa(HTX_SL_REQ_UPTR(sl), HTX_SL_REQ_ULEN(sl), &addr, NULL) < 0)
return 0;
if (addr.ss_family != AF_INET)
return 0;