BUG/MEDIUM: http: cook_cnt() forgets to set its output type

Since comit b805f71 (MEDIUM: sample: let the cast functions set their
output type), the output type of a fetch function is automatically
considered and passed to the next converter. A bug introduced in
1.5-dev9 with commit f853c46 (MEDIUM: pattern/acl: get rid of
temp_pattern in ACLs) was revealed by this last one : the output type
remained string instead of UINT, causing the cast function to try to
cast the contents and to crash on a NULL deref.

Note: this fix was made after a careful review of all fetch functions.
A few non-trivial ones had their comments amended to clearly indicate
the output type.

diff --git a/src/payload.c b/src/payload.c
index cd266cdee0a90ca652d28b735809a815c54bec17..bb4c010080c340bdb7add987f4de5a339107654c 100644 (file)
--- a/src/payload.c
+++ b/src/payload.c
@@ -398,8 +398,8 @@ smp_fetch_ssl_hello_sni(struct proxy *px, struct session *s, void *l7, unsigned
 }
 
 /* Fetch the request RDP cookie identified in <cname>:<clen>, or any cookie if
- * <clen> is empty (cname is then ignored). It returns the data into sample <smp>.
- * Note: this decoder only works with non-wrapping data.
+ * <clen> is empty (cname is then ignored). It returns the data into sample <smp>
+ * of type SMP_T_CSTR. Note: this decoder only works with non-wrapping data.
  */
 int
 fetch_rdp_cookie_name(struct session *s, struct sample *smp, const char *cname, int clen)
@@ -490,7 +490,8 @@ fetch_rdp_cookie_name(struct session *s, struct sample *smp, const char *cname,
 /* Fetch the request RDP cookie identified in the args, or any cookie if no arg
  * is passed. It is usable both for ACL and for samples. Note: this decoder
  * only works with non-wrapping data. Accepts either 0 or 1 argument. Argument
- * is a string (cookie name), other types will lead to undefined behaviour.
+ * is a string (cookie name), other types will lead to undefined behaviour. The
+ * returned sample has type SMP_T_CSTR.
  */
 int
 smp_fetch_rdp_cookie(struct proxy *px, struct session *s, void *l7, unsigned int opt,

diff --git a/src/proto_http.c b/src/proto_http.c
index bd663ef3382463f686f93de68522d0eba85d7cb3..82863ad9de591ec244ad0c9a488c4acf723128be 100644 (file)
--- a/src/proto_http.c
+++ b/src/proto_http.c
@@ -9304,6 +9304,7 @@ smp_fetch_path(struct proxy *px, struct session *l4, void *l7, unsigned int opt,
  * that '*' will not be added, resulting in exactly the first Host entry.
  * If no Host header is found, then the path is returned as-is. The returned
  * value is stored in the trash so it does not need to be marked constant.
+ * The returned sample is of type string.
  */
 static int
 smp_fetch_base(struct proxy *px, struct session *l4, void *l7, unsigned int opt,
@@ -9615,6 +9616,7 @@ extract_cookie_value(char *hdr, const char *hdr_end,
  * The cookie name is in args and the name length in args->data.str.len.
  * Accepts exactly 1 argument of type string. If the input options indicate
  * that no iterating is desired, then only last value is fetched if any.
+ * The returned sample is of type CSTR.
  */
 static int
 smp_fetch_cookie(struct proxy *px, struct session *l4, void *l7, unsigned int opt,
@@ -9711,8 +9713,8 @@ smp_fetch_cookie(struct proxy *px, struct session *l4, void *l7, unsigned int op
 
 /* Iterate over all cookies present in a request to count how many occurrences
  * match the name in args and args->data.str.len. If <multi> is non-null, then
- * multiple cookies may be parsed on the same line.
- * Accepts exactly 1 argument of type string.
+ * multiple cookies may be parsed on the same line. The returned sample is of
+ * type UINT. Accepts exactly 1 argument of type string.
  */
 static int
 smp_fetch_cookie_cnt(struct proxy *px, struct session *l4, void *l7, unsigned int opt,
@@ -9771,6 +9773,7 @@ smp_fetch_cookie_cnt(struct proxy *px, struct session *l4, void *l7, unsigned in
                }
        }
 
+       smp->type = SMP_T_UINT;
        smp->data.uint = cnt;
        smp->flags |= SMP_F_VOL_HDR;
        return 1;