BUG/MEDIUM: sample: properly verify that variables cast to sample
The various variable-to-sample converters allow to turn a variable to
a sample of type string, sint or binary, but both the string one used
by strcmp() and the binary one used by secure_memcmp() are missing a
pointer check on the ability to the cast, making them crash if a
variable of type addr is used with strcmp(), or if an addr or bool is
used with secure_memcmp().
Let's rely on the new sample_conv_var2smp() function to run the proper
checks.
This will need to be backported to all supported version. It relies on
previous commits:
CLEANUP: server: always include the storage for SSL settings
CLEANUP: sample: rename sample_conv_var2smp() to *_sint
CLEANUP: sample: uninline sample_conv_var2smp_str()
MINOR: sample: provide a generic var-to-sample conversion function
For backports it's probably easier to check the sample_casts[] pointer
before calling it in sample_conv_strcmp() and sample_conv_secure_memcmp().
(cherry picked from commit 2476ff102faa3217409e8e29acdb077a9a1dcf8a)
Signed-off-by: Christopher Faulet <cfaulet@haproxy.com>
diff --git a/src/sample.c b/src/sample.c
index 3c31218..91fb0a7 100644
--- a/src/sample.c
+++ b/src/sample.c
@@ -1776,13 +1776,7 @@
smp->flags = SMP_F_CONST;
return 1;
case ARGT_VAR:
- if (!vars_get_by_desc(&arg->data.var, smp))
- return 0;
- if (!sample_casts[smp->data.type][SMP_T_STR])
- return 0;
- if (!sample_casts[smp->data.type][SMP_T_STR](smp))
- return 0;
- return 1;
+ return sample_conv_var2smp(&arg->data.var, smp, SMP_T_STR);
default:
return 0;
}
@@ -2895,13 +2889,7 @@
smp->data.u.sint = arg->data.sint;
return 1;
case ARGT_VAR:
- if (!vars_get_by_desc(&arg->data.var, smp))
- return 0;
- if (!sample_casts[smp->data.type][SMP_T_SINT])
- return 0;
- if (!sample_casts[smp->data.type][SMP_T_SINT](smp))
- return 0;
- return 1;
+ return sample_conv_var2smp(&arg->data.var, smp, SMP_T_SINT);
default:
return 0;
}
@@ -3282,9 +3270,8 @@
smp_set_owner(&tmp, smp->px, smp->sess, smp->strm, smp->opt);
if (arg_p[0].type != ARGT_VAR)
return 0;
- if (!vars_get_by_desc(&arg_p[0].data.var, &tmp))
- return 0;
- if (!sample_casts[tmp.data.type][SMP_T_STR](&tmp))
+
+ if (!sample_conv_var2smp(&arg_p[0].data.var, &tmp, SMP_T_STR))
return 0;
max = MIN(smp->data.u.str.data, tmp.data.u.str.data);
@@ -3320,9 +3307,8 @@
smp_set_owner(&tmp, smp->px, smp->sess, smp->strm, smp->opt);
if (arg_p[0].type != ARGT_VAR)
return 0;
- if (!vars_get_by_desc(&arg_p[0].data.var, &tmp))
- return 0;
- if (!sample_casts[tmp.data.type][SMP_T_BIN](&tmp))
+
+ if (!sample_conv_var2smp(&arg_p[0].data.var, &tmp, SMP_T_BIN))
return 0;
if (smp->data.u.str.data != tmp.data.u.str.data) {