tree 28abb9f2639fe4e47b5c88b08770af54e2c8a51a
parent f1cc5d0eaf8ac56ef574d7349e34a255b149869a
author Christopher Faulet <cfaulet@haproxy.com> 1486552627 +0100
committer Willy Tarreau <w@1wt.eu> 1486577318 +0100
encoding latin1

BUG/MEDIUM: http: Prevent replace-header from overwriting a buffer

This is the same fix as which concerning the redirect rules (0d94576c).

The buffer used to expand the <replace-fmt> argument must be protected to
prevent it being overwritten during build_logline() execution (the function used
to expand the format string).

This patch should be backported in 1.7, 1.6 and 1.5. It relies on commit b686afd
("MINOR: chunks: implement a simple dynamic allocator for trash buffers") for
the trash allocator, which has to be backported as well.