From cd4fe17a2686c7af474340f920eed93f26cecab8 Mon Sep 17 00:00:00 2001 From: Willy Tarreau Date: Sun, 3 Dec 2017 11:51:31 +0100 Subject: [PATCH] BUG/MINOR: h2: ":path" must not be empty As reported by h2spec, the h2->h1 gateway doesn't verify that ":path" is not empty. This is harmless since the H1 parser will reject such a request, but better fix it anyway. To backport to 1.8. --- src/h2.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/src/h2.c b/src/h2.c index 183b7c374..3c580d196 100644 --- a/src/h2.c +++ b/src/h2.c @@ -83,6 +83,10 @@ static int h2_prepare_h1_reqline(uint32_t fields, struct ist *phdr, char **ptr, } } + /* 7540#8.1.2.3: :path must not be empty */ + if (!phdr[uri_idx].len) + goto fail; + if (out + phdr[H2_PHDR_IDX_METH].len + 1 + phdr[uri_idx].len + 11 > end) { /* too large */ goto fail;