tree cfeafd80e0d058391968307d80ee46186b149018
parent e115b49c399a0fd9cfa07ae41531549144ced9b0
author Willy Tarreau <w@1wt.eu> 1430517947 +0200
committer Willy Tarreau <w@1wt.eu> 1430518243 +0200
encoding latin1

BUG/MAJOR: http: prevent risk of reading past end with balance url_param

The get_server_ph_post() function assumes that the buffer is contiguous.
While this is true for all the header part, it is not necessarily true
for the end of data the fit in the reserve. In this case there's a risk
to read past the end of the buffer for a few hundred bytes, and possibly
to crash the process if what follows is not mapped.

The fix consists in truncating the analyzed length to the length of the
contiguous block that follows the headers.

A config workaround for this bug would be to disable balance url_param.

This fix must be backported to 1.5. It seems 1.4 did have the check.