From: Willy Tarreau <w@1wt.eu>
Date: Sun, 6 Dec 2009 17:16:59 +0000 (+0100)
Subject: [BUG] check_post: limit analysis to the buffer length
X-Git-Tag: v1.3.23~27
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=6179630e0fb64c4d35e06743cfc84f02dfdf1517;p=thirdparty%2Fhaproxy.git

[BUG] check_post: limit analysis to the buffer length

If "balance url_param XXX check_post" is used, we must bound the
number of bytes analysed to the buffer's length.
(cherry picked from commit dc8017ced6a8ec699a50a409f3c8ce5928ea70fa)
---

diff --git a/src/backend.c b/src/backend.c
index cd2b54fd87..54b55a7472 100644
--- a/src/backend.c
+++ b/src/backend.c
@@ -1248,6 +1248,9 @@ struct server *get_server_ph_post(struct session *s)
 		len = chunk;
 	}
 
+	if (len > req->l - body)
+		len = req->l - body;
+
 	p = params;
 
 	while (len > plen) {