tree ed72bcfb09781a38a68aad762337753d3ba8e9e9
parent c611e6681b6ed4194b2e9ad0b096c275ab5c4012
author Willy Tarreau <w@1wt.eu> 1512290690 +0100
committer Willy Tarreau <w@1wt.eu> 1512331720 +0100
encoding latin1

BUG/MAJOR: h2: correctly check the request length when building an H1 request

Due to a typo in the request maximum length calculation, we count the
request path twice instead of counting it added to the method's length.
This has two effects, the first one being that a path cannot be larger
than half a buffer, and the second being that the method's length isn't
properly checked. Due to the way the temporary buffers are used internally,
it is quite difficult to meet this condition. In practice, the only
situation where this can cause a problem is when exactly one of either
the method or the path are compressed and the other ones is sent as a
literal.

Thanks to Yves Lafon for providing useful traces exhibiting this issue.

To be backported to 1.8.