From f70fc75296aa899baac390a21a4ddbcb135f4b67 Mon Sep 17 00:00:00 2001 From: Willy Tarreau Date: Fri, 19 Nov 2010 11:27:18 +0100 Subject: [PATCH] [BUG] capture: do not capture a cookie if there is no memory left In case of out of memory, it was possible to write to a null pointer when capturing response cookies due to a missing "else" block. The request handling was fine though. (cherry picked from commit 62e3604d7dd27741c0b4c9e27d9e7c73495dfc32) --- src/proto_http.c | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-) diff --git a/src/proto_http.c b/src/proto_http.c index db8676932..e06a78274 100644 --- a/src/proto_http.c +++ b/src/proto_http.c @@ -6766,11 +6766,12 @@ void manage_server_side_cookies(struct session *t, struct buffer *res) if ((txn->srv_cookie = pool_alloc2(pool2_capture)) == NULL) { Alert("HTTP logging : out of memory.\n"); } - - if (log_len > t->fe->capture_len) - log_len = t->fe->capture_len; - memcpy(txn->srv_cookie, att_beg, log_len); - txn->srv_cookie[log_len] = 0; + else { + if (log_len > t->fe->capture_len) + log_len = t->fe->capture_len; + memcpy(txn->srv_cookie, att_beg, log_len); + txn->srv_cookie[log_len] = 0; + } } /* now check if we need to process it for persistence */