[BUG] check_post: limit analysis to the buffer length

If "balance url_param XXX check_post" is used, we must bound the
number of bytes analysed to the buffer's length.
(cherry picked from commit dc8017ced6a8ec699a50a409f3c8ce5928ea70fa)

diff --git a/src/backend.c b/src/backend.c
index cd2b54fd872ad161a73358e405fd053e3bd84377..54b55a74721b18d5420dd2b41a331c1b3b6bd6fe 100644 (file)
--- a/src/backend.c
+++ b/src/backend.c
@@ -1248,6 +1248,9 @@ struct server *get_server_ph_post(struct session *s)
                len = chunk;
        }
 
+       if (len > req->l - body)
+               len = req->l - body;
+
        p = params;
 
        while (len > plen) {