BUG/MINOR: h1: report the right error position on authority/host mismatch

When an absolute-form request target does not match the Host header value,
h1_headers_to_hdr_list() reports the error at two places depending on whether
the message must be blocked or only captured:

	if (h1m->err_pos < -1) {
		state = H1_MSG_LAST_LF;
		ptr = host.ptr; /* Set ptr on the error */
		goto http_msg_invalid;
	}
	if (h1m->err_pos == -1) /* capture the error pointer */
		h1m->err_pos = v.ptr - start + skip; /* >= 0 now */

The strict path correctly points at the Host header value while the tolerant
path uses <v>, which at this point still holds the value of the *last* parsed
header field, whatever it was. So with "option
accept-unsafe-violations-in-http-request" enabled, the offset stored in
h1m->err_pos, later used by h1_capture_bad_message() and reported by "show
errors", designates an unrelated part of the message.

Let's use host.ptr in both paths.

This was introduced by commit 25bcdb1d9 ("BUG/MAJOR: h1: Be stricter on request
target validation during message parsing") in 3.0-dev12, so it should be
backported to 3.0 and above.

diff --git a/src/h1.c b/src/h1.c
index 7a88fb192d5aceb1a8b61a029e8cb34b618bf37c..6190f479895ae80a1f49c8a61d546d5d3f440438 100644 (file)
--- a/src/h1.c
+++ b/src/h1.c
@@ -1176,7 +1176,7 @@ int h1_headers_to_hdr_list(char *start, const char *stop,
                                                                goto http_msg_invalid;
                                                        }
                                                        if (h1m->err_pos == -1) /* capture the error pointer */
-                                                               h1m->err_pos = v.ptr - start + skip; /* >= 0 now */
+                                                               h1m->err_pos = host.ptr - start + skip; /* >= 0 now */
                                                }
                                        }
                                }