tree 2138c47e6d6d5290349562b9f844192720fddab2
parent e8c7fb35882c453c7d1c2e923a3782a9348d8c5b
author Christopher Faulet <cfaulet@haproxy.com> 1668505588 +0100
committer Christopher Faulet <cfaulet@haproxy.com> 1668587229 +0100

BUG/MEDIUM: mux-fcgi: Avoid value length overflow when it doesn't fit at once

When the request data are copied in a mbuf, if the free space is too small
to copy all data at once, the data length is shortened. When this is
performed, we reserve the size of the STDIN recod header and eventually the
same for the empty STDIN record if it is the last HTX block of the request.

However, there is no test to be sure the free space is large enough. Thus,
on this special case, when the mbuf is almost full, it is possible to
overflow the value length. Because of this bug, it is possible to experience
crashes from time to time.

This patch should fix the issue #1923. It must be backported as far as 2.4.