kozorizki/haproxy
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

BUG/MEDIUM: http: cook_cnt() forgets to set its output type

Browse Source 
Since comit b805f71 (MEDIUM: sample: let the cast functions set their
output type), the output type of a fetch function is automatically
considered and passed to the next converter. A bug introduced in
1.5-dev9 with commit f853c46 (MEDIUM: pattern/acl: get rid of
temp_pattern in ACLs) was revealed by this last one : the output type
remained string instead of UINT, causing the cast function to try to
cast the contents and to crash on a NULL deref.

Note: this fix was made after a careful review of all fetch functions.
A few non-trivial ones had their comments amended to clearly indicate
the output type.
This commit is contained in:
Willy Tarreau 2013-12-16 15:14:43 +01:00
parent e8df1e128d
commit b169eba58d
2 changed files with 9 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
src/payload.c
View File

@ -398,8 +398,8 @@ smp_fetch_ssl_hello_sni(struct proxy *px, struct session *s, void *l7, unsigned
}
/* Fetch the request RDP cookie identified in <cname>:<clen>, or any cookie if
* <clen> is empty (cname is then ignored). It returns the data into sample <smp>.
* Note: this decoder only works with non-wrapping data.
* <clen> is empty (cname is then ignored). It returns the data into sample <smp>
* of type SMP_T_CSTR. Note: this decoder only works with non-wrapping data.
*/
int
fetch_rdp_cookie_name(struct session *s, struct sample *smp, const char *cname, int clen)
@ -490,7 +490,8 @@ fetch_rdp_cookie_name(struct session *s, struct sample *smp, const char *cname,
/* Fetch the request RDP cookie identified in the args, or any cookie if no arg
* is passed. It is usable both for ACL and for samples. Note: this decoder
* only works with non-wrapping data. Accepts either 0 or 1 argument. Argument
* is a string (cookie name), other types will lead to undefined behaviour.
* is a string (cookie name), other types will lead to undefined behaviour. The
* returned sample has type SMP_T_CSTR.
*/
int
smp_fetch_rdp_cookie(struct proxy *px, struct session *s, void *l7, unsigned int opt,

7
src/proto_http.c
View File

@ -9304,6 +9304,7 @@ smp_fetch_path(struct proxy *px, struct session *l4, void *l7, unsigned int opt,
* that '*' will not be added, resulting in exactly the first Host entry.
* If no Host header is found, then the path is returned as-is. The returned
* value is stored in the trash so it does not need to be marked constant.
* The returned sample is of type string.
*/
static int
smp_fetch_base(struct proxy *px, struct session *l4, void *l7, unsigned int opt,
@ -9615,6 +9616,7 @@ extract_cookie_value(char *hdr, const char *hdr_end,
* The cookie name is in args and the name length in args->data.str.len.
* Accepts exactly 1 argument of type string. If the input options indicate
* that no iterating is desired, then only last value is fetched if any.
* The returned sample is of type CSTR.
*/
static int
smp_fetch_cookie(struct proxy *px, struct session *l4, void *l7, unsigned int opt,
@ -9711,8 +9713,8 @@ smp_fetch_cookie(struct proxy *px, struct session *l4, void *l7, unsigned int op
/* Iterate over all cookies present in a request to count how many occurrences
* match the name in args and args->data.str.len. If <multi> is non-null, then
* multiple cookies may be parsed on the same line.
* Accepts exactly 1 argument of type string.
* multiple cookies may be parsed on the same line. The returned sample is of
* type UINT. Accepts exactly 1 argument of type string.
*/
static int
smp_fetch_cookie_cnt(struct proxy *px, struct session *l4, void *l7, unsigned int opt,
@ -9771,6 +9773,7 @@ smp_fetch_cookie_cnt(struct proxy *px, struct session *l4, void *l7, unsigned in
}
}
smp->type = SMP_T_UINT;
smp->data.uint = cnt;
smp->flags |= SMP_F_VOL_HDR;
return 1;