sinjuginas/haproxy
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

[BUG] Fix NULL pointer dereference in stats_check_uri_auth(), v2

Browse Source 
Recent "struct chunk rework" introduced a NULL pointer dereference
and now haproxy segfaults if auth is required for stats but not found.

The reason is that size_t cannot store negative values, but current
code assumes that "len < 0" == uninitialized.

This patch fixes it.
This commit is contained in:
Krzysztof Piotr Oledzki 2009-10-04 23:34:15 +02:00 committed by Willy Tarreau
parent ac68c5d92c
commit 6f61b21524
3 changed files with 4 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
include/proto/buffers.h
View File

@ -439,9 +439,9 @@ static inline void chunk_init(struct chunk *chk, char *str, size_t size) {
} }
/* report 0 in case of error, 1 if OK. */ /* report 0 in case of error, 1 if OK. */
static inline int chunk_initlen(struct chunk *chk, char *str, size_t size, size_t len) { static inline int chunk_initlen(struct chunk *chk, char *str, size_t size, int len) {
if (len > size) if (size && len > size)
return 0; return 0;
chk->str = str; chk->str = str;

2
include/types/buffers.h
View File

@ -149,7 +149,7 @@
struct chunk { struct chunk {
char *str; /* beginning of the string itself. Might not be 0-terminated */ char *str; /* beginning of the string itself. Might not be 0-terminated */
size_t size; /* total size of the buffer, 0 if the *str is read-only */ size_t size; /* total size of the buffer, 0 if the *str is read-only */
size_t len; /* current size of the string from first to last char. <0 = uninit. */ int len; /* current size of the string from first to last char. <0 = uninit. */
}; };
/* needed for a declaration below */ /* needed for a declaration below */

3
src/proto_http.c
View File

@ -4596,8 +4596,7 @@ int stats_check_uri_auth(struct session *t, struct proxy *backend)
int len = txn->hdr_idx.v[cur_idx].len; int len = txn->hdr_idx.v[cur_idx].len;
if (len > 14 && if (len > 14 &&
!strncasecmp("Authorization:", h, 14)) { !strncasecmp("Authorization:", h, 14)) {
txn->auth_hdr.str = h; chunk_initlen(&txn->auth_hdr, h, 0, len);
txn->auth_hdr.len = len;
break; break;
} }
h += len + txn->hdr_idx.v[cur_idx].cr + 1; h += len + txn->hdr_idx.v[cur_idx].cr + 1;