From: Willy Tarreau <w@1wt.eu>
Date: Thu, 20 Jan 2022 07:47:35 +0000 (+0100)
Subject: BUG/MEDIUM: mcli: always realign wrapping buffers before parsing them
X-Git-Tag: v2.6-dev1~106
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=a4e4d66f701b58da87cad0a2a90dea7e7553bc71;p=thirdparty%2Fhaproxy.git

BUG/MEDIUM: mcli: always realign wrapping buffers before parsing them

Pipelined commands easily result in request buffers to wrap, and the
master-cli parser only deals with linear buffers since it needs contiguous
keywords to look for in a list. As soon as a buffer wraps, some commands
are ignored and the parser is called in loops because the wrapped data
do not leave the buffer.

Let's take the easiest path that's already used at the HTTP layer, we
simply realign the buffer if its input wraps. This rarely happens anyway
(typically once per buffer), remains reasonably cheap and guarantees this
cannot happen anymore.

This needs to be backported as far as 2.0.
---

diff --git a/src/cli.c b/src/cli.c
index 3744ac3acc..16ddf05267 100644
--- a/src/cli.c
+++ b/src/cli.c
@@ -2278,8 +2278,8 @@ int pcli_find_and_exec_kw(struct stream *s, char **args, int argl, char **errmsg
  */
 int pcli_parse_request(struct stream *s, struct channel *req, char **errmsg, int *next_pid)
 {
-	char *str = (char *)ci_head(req);
-	char *end = (char *)ci_stop(req);
+	char *str;
+	char *end;
 	char *args[MAX_CLI_ARGS + 1]; /* +1 for storing a NULL */
 	int argl; /* number of args */
 	char *p;
@@ -2290,6 +2290,15 @@ int pcli_parse_request(struct stream *s, struct channel *req, char **errmsg, int
 	int ret;
 	int i = 0;
 
+	/* we cannot deal with a wrapping buffer, so let's take care of this
+	 * first.
+	 */
+	if (b_head(&req->buf) + b_data(&req->buf) > b_wrap(&req->buf))
+		b_slow_realign(&req->buf, trash.area, co_data(req));
+
+	str = (char *)ci_head(req);
+	end = (char *)ci_stop(req);
+
 	p = str;
 
 	if (!(s->pcli_flags & PCLI_F_PAYLOAD)) {