tree e65ed559d1a2b145c742a7acf9a194312940a2f6
parent a85cfb1db5fd0869366d3178e4103c72cbfe2a83
author Thierry FOURNIER <tfournier@haproxy.com> 1426500881 +0100
committer Willy Tarreau <w@1wt.eu> 1426512007 +0100
encoding latin1

BUG/MAJOR: http: don't read past buffer's end in http_replace_value

The function http_replace_value use bad variable to detect the end
of the input string.

Regression introduced by the patch "MEDIUM: regex: Remove null
terminated strings." (c9c2daf2)

We need to backport this patch int the 1.5 stable branch.

WT: there is no possibility to overwrite existing data as we only read
    past the end of the request buffer, to copy into the trash. The copy
    is bounded by buffer_replace2(), just like the replacement performed
    by exp_replace(). However if a buffer happens to contain non-zero data
    up to the next unmapped page boundary, there's a theorical risk of
    crashing the process despite this not being reproducible in tests.
    The risk is low because "http-request replace-value" did not work due
    to this bug so that probably means it's not used yet.