tree 864a82970757f01b0bc83fefc02dafab46c8323b
parent bcd033699c5a4904967652de4980e4f35f17ee34
author Willy Tarreau <w@1wt.eu> 1441647153 +0200
committer Willy Tarreau <w@1wt.eu> 1441648018 +0200
encoding latin1

BUG/MAJOR: http: don't call http_send_name_header() after an error

A crash was reported when using the "famous" http-send-name-header
directive. This time it's a bit tricky, it requires a certain number of
conditions to be met including maxconn on a server, queuing, timeout in
the queue and cookie-based persistence.

The problem is that in stream.c, before calling http_send_name_header(),
we check a number of conditions to know if we have to replace the header
name. But prior to reaching this place, it's possible for
sess_update_stream_int() to fail and change the stream-int's state to
SI_ST_CLO, send an error 503 to the client, and flush all buffers. But
http_send_name_header() can only be called with valid buffer contents
matching the http_msg's description. So when it rewinds the stream to
modify the header, buf->o becomes negative by the size of the incoming
request and is used as the argument to memmove() which basically
displaces 4GB of memory off a few bytes to write the new name, resulting
in a core and a core file that's really not fun to play with.

The solution obviously consists in refraining from calling this nasty
function when the stream interface is already closed.

This bug also affects 1.5 and possibly 1.4, so the fix must be backported
there.
(cherry picked from commit 9c03b33329cb4924716edc1c851913a18b0670dc)