]> git.ipfire.org Git - thirdparty/haproxy.git/commit
BUG/MAJOR: http: http_txn_get_path() may deference an inexisting buffer
authorWilly Tarreau <w@1wt.eu>
Sun, 28 Oct 2018 19:13:12 +0000 (20:13 +0100)
committerWilly Tarreau <w@1wt.eu>
Sun, 28 Oct 2018 19:16:12 +0000 (20:16 +0100)
commit9d9ccdbf8b1178fefa2843c83bc6612733f9eca6
treec6e63f43f2cd27dcc146ed433739c0e9f83dbaec
parent8e9f4531cb18d424139285557f0fe0895fd46c5b
BUG/MAJOR: http: http_txn_get_path() may deference an inexisting buffer

When the "path" sample fetch function is called without any path, the
function doesn't check that the request buffer is allocated. While this
doesn't happen with the request during processing, it can definitely
happen when mistakenly trying to reference a path from the response
since the request channel is not allocated anymore.

It's certain that this bug was emphasized by the buffer changes that
went in 1.9 and the HTTP refactoring, but at first glance, 1.8 doesn't
seem 100% safe either so it's possible that older version are affected
as well.

Thanks to PiBa-NL for reporting this bug with a reproducer.
src/proto_http.c