BUG/MAJOR: Fix crash in http_get_fhdr with exactly MAX_HDR_HISTORY headers
Similar issue was fixed in 67dad27, but the fix is incomplete. Crash still
happened when utilizing req.fhdr() and sending exactly MAX_HDR_HISTORY
headers.
This fix needs to be backported to 1.5 and 1.6.
Signed-off-by: Nenad Merdanovic <nmerdan@anine.io>
(cherry picked from commit 69ad4b997701b08e9de48fce4dc4ceeb7d80cb32)
(cherry picked from commit dc422d0f091210e4121d4f862e79396d0e69e243)
diff --git a/src/proto_http.c b/src/proto_http.c
index a5323e4..2622e2b 100644
--- a/src/proto_http.c
+++ b/src/proto_http.c
@@ -8682,10 +8682,13 @@
}
if (-occ > found)
return 0;
+
/* OK now we have the last occurrence in [hist_ptr-1], and we need to
- * find occurrence -occ, so we have to check [hist_ptr+occ].
+ * find occurrence -occ. 0 <= hist_ptr < MAX_HDR_HISTORY, and we have
+ * -10 <= occ <= -1. So we have to check [hist_ptr%MAX_HDR_HISTORY+occ]
+ * to remain in the 0..9 range.
*/
- hist_ptr += occ;
+ hist_ptr += occ + MAX_HDR_HISTORY;
if (hist_ptr >= MAX_HDR_HISTORY)
hist_ptr -= MAX_HDR_HISTORY;
*vptr = ptr_hist[hist_ptr];