kozorizki/haproxy
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

BUG/MINOR: compression: possible NULL dereferences in comp_prepare_compress_request()

Browse Source 
This bug was introduced in ead43fe4f2 ("MEDIUM: compression: Make it so
we can compress requests as well.")

2 cases where not properly handled, resulting in 2 possible NULL
dereferences leading to crashes in the function at runtime:
 - when the backend didn't define any compression options so its comp
   pointer is NULL (ie: if only the frontend defines some comp options)
 - when both the frontend and the backend didn't set a compression algo
   but at least one of the two defined some other comp options (comp
   pointer set)

For the first case, we added the missing checks to make sure we don't
read ->comp pointer if it is NULL.
For the second case, we properly return from the function if no
compression algo is defined, because there is no default value that could
be used as a fallback.

This should be backported to 2.8.
This commit is contained in:
Aurelien DARRAGON 2023-11-28 15:47:25 +01:00 committed by Christopher Faulet
parent 2f2cb6d082
commit d3cbd36950
1 changed files with 4 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
src/flt_http_comp.c
View File

@ -183,10 +183,12 @@ comp_prepare_compress_request(struct comp_state *st, struct stream *s, struct ht
if (txn->meth == HTTP_METH_HEAD)
return;
if (s->be->comp->algo_req != NULL)
if (s->be->comp && s->be->comp->algo_req != NULL)
st->comp_algo[COMP_DIR_REQ] = s->be->comp->algo_req;
else if (strm_fe(s)->comp->algo_req != NULL)
else if (strm_fe(s)->comp && strm_fe(s)->comp->algo_req != NULL)
st->comp_algo[COMP_DIR_REQ] = strm_fe(s)->comp->algo_req;
else
goto fail; /* no algo selected: nothing to do */
/* limit compression rate */