tree b3fe8442a55688a8981bb74d041bfa3efd8348ab
parent 754b2428d37ad3a01531dc8ae5c3a32301311cda
author Tim Duesterhus <tim@bastelstu.be> 1606252976 +0100
committer William Lallemand <wlallemand@haproxy.org> 1606296180 +0100

BUG/CRITICAL: cache: Fix trivial crash by sending accept-encoding header

Since commit 3d08236cb344607557f22e00cf1cc3e321a1fa95 HAProxy can be trivially
crashed remotely by sending an `accept-encoding` HTTP request header that
contains 16 commas.

This is because the `values` array in `accept_encoding_normalizer` accepts only
16 entries and it is not verified whether the end is reached during looping.

Fix this issue by checking the length. This patch also simplifies the ist
processing in the loop, because it manually calculated offsets and lengths,
when the ist API exposes perfectly safe functions to advance and truncate ists.

I wonder whether the accept_encoding_normalizer function is able to re-use some
existing function for parsing headers that may contain lists of values. I'll
leave this evaluation up to someone else, only patching the obvious crash.

This commit is 2.4-dev specific and was merged just a few hours ago. No
backport needed.