From: Willy Tarreau <w@1wt.eu>
Date: Fri, 8 May 2015 14:13:42 +0000 (+0200)
Subject: BUG/MEDIUM: http: fix the http-request capture parser
X-Git-Tag: v1.6-dev2~133
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=3986ac186045a17f79d42084160fb57918814e73;p=thirdparty%2Fhaproxy.git

BUG/MEDIUM: http: fix the http-request capture parser

Due to the code being mostly inspired from the tcp-request parser, it
does some crap because both don't work the same way. The "len" argument
could be mismatched and then the length could be used uninitialized.
---

diff --git a/src/proto_http.c b/src/proto_http.c
index 275f329006..957640ecef 100644
--- a/src/proto_http.c
+++ b/src/proto_http.c
@@ -12163,7 +12163,7 @@ int parse_http_req_capture(const char **args, int *orig_arg, struct proxy *px, s
 	struct sample_expr *expr;
 	struct cap_hdr *hdr;
 	int cur_arg;
-	int len;
+	int len = 0;
 
 	for (cur_arg = *orig_arg; cur_arg < *orig_arg + 3 && *args[cur_arg]; cur_arg++)
 		if (strcmp(args[cur_arg], "if") == 0 ||