tree 26425f4444084c3cb4442a9b081a604443041fa2
parent 2100b491229a177ce34b7928002e10caab5b7781
author Willy Tarreau <w@1wt.eu> 1437576336 +0200
committer Willy Tarreau <w@1wt.eu> 1437576802 +0200
encoding latin1

BUG/MAJOR: dns: fix the length of the string to be copied

Jan A. Bruder reported that some very specific hostnames on server
lines were causing haproxy to crash on startup. Given that hist
backtrace showed some heap corruption, it was obvious there was an
overflow somewhere. The bug in fact is a typo in dns_str_to_dn_label()
which mistakenly copies one extra byte from the host name into the
output value, thus effectively corrupting the structure.

The bug triggers while parsing the next server of similar length
after the corruption, which generally triggers at config time but
could theorically crash at any moment during runtime depending on
what malloc sizes are needed next. This is why it's tagged major.

No backport is needed, this bug was introduced in 1.6-dev2.