mirrors/haproxy
1
0
Fork 0
mirror of https://git.haproxy.org/git/haproxy.git/ synced 2025-08-07 07:37:02 +02:00
Code Issues Projects Releases Wiki Activity

BUG/MINOR: jwt: fix jwt_verify crash on 32-bit archs

Browse Source 
The jwt_verify converter was added in 2.5 with commit 130e142ee2
("MEDIUM: jwt: Add jwt_verify converter to verify JWT integrity"). It
takes a string on input and returns an integer. It turns out that by
presetting the return value to zero before processing contents, while
the sample data is a union, it overwrites the beginning of the buffer
struct passed on input. On a 64-bit arch it's not an issue because it's
where the allocated size is stored and it's not used in the operation,
which explains why the regtest works. But on 32-bit, both the size and
the pointer are overwritten, causing a NULL pointer to be passed to
jwt_tokenize() which is not designed to support this, hence crashes.

Let's just use a temporary variable to hold the result and move the
output sample initialization to the end of the function.

This should be backported as far as 2.5.
This commit is contained in:
Willy Tarreau 2024-01-24 10:31:05 +01:00
parent ef02dba7bc
commit e41638af33
1 changed files with 4 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
src/sample.c
View File

@ -4270,9 +4270,7 @@ static int sample_conv_jwt_verify_check(struct arg *args, struct sample_conv *co
static int sample_conv_jwt_verify(const struct arg *args, struct sample *smp, void *private)
{
struct sample alg_smp, key_smp;
smp->data.type = SMP_T_SINT;
smp->data.u.sint = 0;
enum jwt_vrfy_status ret;
smp_set_owner(&alg_smp, smp->px, smp->sess, smp->strm, smp->opt);
smp_set_owner(&key_smp, smp->px, smp->sess, smp->strm, smp->opt);
@ -4281,9 +4279,10 @@ static int sample_conv_jwt_verify(const struct arg *args, struct sample *smp, vo
if (!sample_conv_var2smp_str(&args[1], &key_smp))
return 0;
smp->data.u.sint = jwt_verify(&smp->data.u.str, &alg_smp.data.u.str,
&key_smp.data.u.str);
ret = jwt_verify(&smp->data.u.str, &alg_smp.data.u.str, &key_smp.data.u.str);
smp->data.type = SMP_T_SINT;
smp->data.u.sint = ret;
return 1;
}