From: Christopher Faulet <cfaulet@haproxy.com>
Date: Fri, 11 Jun 2021 11:39:06 +0000 (+0200)
Subject: BUG/MINOR: h1-htx: Fix a signess bug with char data type when parsing chunk size
X-Git-Tag: v2.5-dev1~154
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=bf76df12a6eb8a69939da026815b6daa9dfd7147;p=thirdparty%2Fhaproxy.git

BUG/MINOR: h1-htx: Fix a signess bug with char data type when parsing chunk size

On some platform, a char may be unsigned. Of course, we should not rely on
the signess of a char to be portable. Unfortunatly, since the commit
a835f3cb ("MINOR: h1-htx: Use a correlation table to speed-up small chunks
parsing") we rely on it to test the value retrieved from the hexadecimal
correlation table when the size of a chunk is parsed.

To fix the bug, we now test the result is in the range [0,15] with a bitwise
AND.

This patch should fix the issue #1272. It is 2.5-specific, no backport is
needed except if the commit above is backported.
---

diff --git a/src/h1_htx.c b/src/h1_htx.c
index b4c49c781f..878c45db8a 100644
--- a/src/h1_htx.c
+++ b/src/h1_htx.c
@@ -612,7 +612,7 @@ static size_t h1_parse_full_contig_chunks(struct h1m *h1m, struct htx **dsthtx,
 			c = hextable[(unsigned char)end[ridx]];
 
 			/* not a hex digit anymore */
-			if (c < 0)
+			if (c & 0xF0)
 				break;
 
 			/* Update current chunk size */