tree 215c9830bbe622e1116791065c97ed3df256b1c5
parent be80167b366dcaab54c0e4e82b39abd2f2239404
author Willy Tarreau <w@1wt.eu> 1456413319 +0100
committer Willy Tarreau <w@1wt.eu> 1456414088 +0100
encoding latin1

BUG/MEDIUM: chunks: always reject negative-length chunks

The recent addition of "show env" on the CLI has revealed an interesting
design bug. Chunks are supposed to support a negative length to indicate
that they carry no data. chunk_printf() sets this size to -1 if the string
is too large for the buffer. At a few places in the http engine we may end
up with trash.len = -1. But bi_putchk(), chunk_appendf() and a few other
chunks consumers don't consider this case as possible and will use such a
chunk, possibly restoring an invalid string or trying to copy -1 bytes.

This fix takes care of clarifying the situation in a backportable way
where such sizes are used, so that a negative length indicating an error
remains present until the chunk is reinitialized or overwritten. But a
cleaner design adjustment needs to be done so that there's a clear contract
on how to use these chunks. At first glance it doesn't seem *that* useful
to support negative sizes, so probably this is what should change.

This fix must be backported to 1.6 and 1.5.
(cherry picked from commit 320ec2a7454a84a6bb318a8a132d0300b712937f)
(cherry picked from commit 4d747c277358907f1a68a96d890d984d7ebfb0eb)