tree c6e63f43f2cd27dcc146ed433739c0e9f83dbaec
parent 8e9f4531cb18d424139285557f0fe0895fd46c5b
author Willy Tarreau <w@1wt.eu> 1540753992 +0100
committer Willy Tarreau <w@1wt.eu> 1540754172 +0100
encoding latin1

BUG/MAJOR: http: http_txn_get_path() may deference an inexisting buffer

When the "path" sample fetch function is called without any path, the
function doesn't check that the request buffer is allocated. While this
doesn't happen with the request during processing, it can definitely
happen when mistakenly trying to reference a path from the response
since the request channel is not allocated anymore.

It's certain that this bug was emphasized by the buffer changes that
went in 1.9 and the HTTP refactoring, but at first glance, 1.8 doesn't
seem 100% safe either so it's possible that older version are affected
as well.

Thanks to PiBa-NL for reporting this bug with a reproducer.