BUG/MAJOR: http: prevent risk of reading past end with balance url_param

The get_server_ph_post() function assumes that the buffer is contiguous.
While this is true for all the header part, it is not necessarily true
for the end of data the fit in the reserve. In this case there's a risk
to read past the end of the buffer for a few hundred bytes, and possibly
to crash the process if what follows is not mapped.

The fix consists in truncating the analyzed length to the length of the
contiguous block that follows the headers.

A config workaround for this bug would be to disable balance url_param.

This fix must be backported to 1.5. It seems 1.4 did have the check.

diff --git a/src/backend.c b/src/backend.c
index 75792bde0d144a696d11bda405e3b2763679441a..17a55d66854abf75a903682e6b9d423857054200 100644 (file)
--- a/src/backend.c
+++ b/src/backend.c
@@ -313,6 +313,9 @@ struct server *get_server_ph_post(struct stream *s)
        if (len == 0)
                return NULL;
 
+       if (len > req->buf->data + req->buf->size - p)
+               len = req->buf->data + req->buf->size - p;
+
        if (px->lbprm.tot_weight == 0)
                return NULL;