tree 2050cc82139949639755944983985485de840fe3
parent 77eb9b8a2d9a9b57b6f60c22a3d0203bbd7a936d
author Willy Tarreau <w@1wt.eu> 1290619888 +0100
committer Willy Tarreau <w@1wt.eu> 1290924382 +0100
encoding latin1

[CRITICAL] cookies: mixing cookies in indirect mode and appsession can crash the process

Cookies in indirect mode are removed from the cookie header. Three pointers
ought to be updated when appsession cookies are processed next, but were not.
The result is that a memcpy() can be called with a negative value causing the
process to crash. It is not sure whether this can be remotely exploited or not.
(cherry picked from commit c5f3749aa3ccfdebc4992854ea79823d26f66213)