sinjuginas/haproxy
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

BUG/MEDIUM: mux-fcgi: Avoid value length overflow when it doesn't fit at once

Browse Source 
When the request data are copied in a mbuf, if the free space is too small
to copy all data at once, the data length is shortened. When this is
performed, we reserve the size of the STDIN recod header and eventually the
same for the empty STDIN record if it is the last HTX block of the request.

However, there is no test to be sure the free space is large enough. Thus,
on this special case, when the mbuf is almost full, it is possible to
overflow the value length. Because of this bug, it is possible to experience
crashes from time to time.

This patch should fix the issue #1923. It must be backported as far as 2.4.
This commit is contained in:
Christopher Faulet 2022-11-15 10:46:28 +01:00
parent e8c7fb3588
commit 52fd8a1b7b
1 changed files with 3 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
src/mux_fcgi.c
View File

@ -2190,7 +2190,9 @@ static size_t fcgi_strm_send_stdin(struct fcgi_conn *fconn, struct fcgi_strm *fs
b_data(&outbuf) + v.len + extra_bytes <= b_room(mbuf) &&
b_data(mbuf) <= MAX_DATA_REALIGN)
goto realign_again;
v.len = b_room(&outbuf) - FCGI_RECORD_HEADER_SZ - extra_bytes;
v.len = (FCGI_RECORD_HEADER_SZ + extra_bytes > b_room(&outbuf)
? 0
: b_room(&outbuf) - FCGI_RECORD_HEADER_SZ - extra_bytes);
}
if (!v.len || !chunk_memcat(&outbuf, v.ptr, v.len)) {
if (outbuf.data == FCGI_RECORD_HEADER_SZ)