tree 447abb7eabfaad60836af822a1085669ff2282e9
parent e2e6cd95fa54f4bb312d73b448110d7a85fd4794
author Christopher Faulet <cfaulet@haproxy.com> 1648474621 +0200
committer Christopher Faulet <cfaulet@haproxy.com> 1648497986 +0200

BUG/MEDIUM: mux-fcgi: Properly handle return value of headers/trailers parsing

h1_parse_msg_hdrs() and h1_parse_msg_tlrs() may return negative values if
the parsing fails or if more space is needed in the destination buffer. When
h1-htx was changed, The H1 mux was updated accordingly but not the FCGI
mux. Thus if a negative value is returned, it is ignored and it is casted to
a size_t, leading to an integer overflow on the <ofs> value, used to know
the position in the RX buffer.

This patch must be backported as far as 2.2.

(cherry picked from commit d9fc12818e4084f76cfa1f31d20a5c17d83ecb3e)
Signed-off-by: Christopher Faulet <cfaulet@haproxy.com>
(cherry picked from commit bfe68e84b178fc5746e0d89a6519dedd1616754b)
Signed-off-by: Christopher Faulet <cfaulet@haproxy.com>