]> git.ipfire.org Git - thirdparty/haproxy.git/commit
BUG/MEDIUM: net_helper: fix a remaining possibly infinite loop in converters
authorWilly Tarreau <w@1wt.eu>
Thu, 21 May 2026 13:00:12 +0000 (15:00 +0200)
committerWilly Tarreau <w@1wt.eu>
Thu, 21 May 2026 13:05:39 +0000 (15:05 +0200)
commit413f6f9a1f74590b064587f539c985c3c2bf0c9e
treeebfff5c1c1454967582c6e7ef45c47f3b32a3a0b
parent3475a5bb9f12fa5ca736d54d0cf1e0ecb3f13ce6
BUG/MEDIUM: net_helper: fix a remaining possibly infinite loop in converters

The various tcp_option_* converters rely on tcp_fullhdr_find_opt() to
find the option. However, the same bug as fixed in commit dbf471f99a
("BUG/MAJOR: net_helper: ip.fp infinite loop on malformed tcp options")
was also present there, by which an option of length 0 could be looped
over indefinitely. In practice this does not happen since such options
are not valid, but if passed encoded in an HTTP header for example, it
could possibly be passed.

While fixing it, let's check for length >1 in all 3 locations insteead
of only non-zero, since there's no point processing a malformed option
that wouldn't even be properly skipped.

This fix doesn't need to be backported, unless the ip.fp series is.

Thanks to @Vincent55 for reporting this issue.
src/net_helper.c