From: Willy Tarreau <w@1wt.eu>
Date: Wed, 29 Apr 2020 09:22:08 +0000 (+0200)
Subject: BUG/MEDIUM: capture: capture-req/capture-res converters crash without a stream
X-Git-Tag: v2.2-dev7~53
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=5575896ba1120f136e680fd669afb5b084faa530;p=thirdparty%2Fhaproxy.git

BUG/MEDIUM: capture: capture-req/capture-res converters crash without a stream

Since commit 5f940703b3 ("MINOR: log: Don't depends on a stream to process
samples in log-format string") it has become quite obvious that a few sample
fetch functions and converters were still heavily dependent on the presence
of a stream without testing for it.

The capture-req and capture-res converters were in this case and could
crash the process if misused.

This fix adds a check for the stream's existence, and should be backported
to all stable versions up to 1.6.
---

diff --git a/src/http_conv.c b/src/http_conv.c
index f496c560cf..fdf3c42f11 100644
--- a/src/http_conv.c
+++ b/src/http_conv.c
@@ -276,7 +276,7 @@ static int sample_conv_url_dec(const struct arg *args, struct sample *smp, void
 
 static int smp_conv_req_capture(const struct arg *args, struct sample *smp, void *private)
 {
-	struct proxy *fe = strm_fe(smp->strm);
+	struct proxy *fe;
 	int idx, i;
 	struct cap_hdr *hdr;
 	int len;
@@ -284,6 +284,10 @@ static int smp_conv_req_capture(const struct arg *args, struct sample *smp, void
 	if (!args || args->type != ARGT_SINT)
 		return 0;
 
+	if (!smp->strm)
+		return 0;
+
+	fe = strm_fe(smp->strm);
 	idx = args->data.sint;
 
 	/* Check the availibity of the capture id. */
@@ -317,7 +321,7 @@ static int smp_conv_req_capture(const struct arg *args, struct sample *smp, void
 
 static int smp_conv_res_capture(const struct arg *args, struct sample *smp, void *private)
 {
-	struct proxy *fe = strm_fe(smp->strm);
+	struct proxy *fe;
 	int idx, i;
 	struct cap_hdr *hdr;
 	int len;
@@ -325,6 +329,10 @@ static int smp_conv_res_capture(const struct arg *args, struct sample *smp, void
 	if (!args || args->type != ARGT_SINT)
 		return 0;
 
+	if (!smp->strm)
+		return 0;
+
+	fe = strm_fe(smp->strm);
 	idx = args->data.sint;
 
 	/* Check the availibity of the capture id. */