tree 995a2cf3f0132631600a6c21b4d3b33e5492e2e1
parent 718f0ef129ec31c8a38632ca475463a03f1c1c00
author Willy Tarreau <w@1wt.eu> 1218406916 +0200
committer Willy Tarreau <w@1wt.eu> 1218447241 +0200

[BUG] fix segfault with url_param + check_post

If an HTTP/0.9-like POST request is sent to haproxy while
configured with url_param + check_post, it will crash. The
reason is that the total buffer length was computed based
on req->total (which equals the number of bytes read) and
not req->l (number of bytes in the buffer), thus leading
to wrong size calculations when calling memchr().

The affected code does not look like it could have been
exploited to run arbitrary code, only reads were performed
at wrong locations.