Attachment 1307658 Details for Bug 1477222 – varnish 5.1 patch

[patch] varnish 5.1 patch

5.1-Correctly-handle-bogusly-large-chunk-sizes.patch (text/plain), 2.20 KB, created by Adam Mariš on 2017-08-01 14:43:14 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Adam Mariš

Created: 2017-08-01 14:43:14 UTC

Size: 2.20 KB

patch

obsolete

>From 49b9af7de9920c18f767161782143e208b1a21f0 Mon Sep 17 00:00:00 2001
>From: Martin Blix Grydeland <martin@varnish-software.com>
>Date: Thu, 27 Jul 2017 11:52:58 +0200
>Subject: [PATCH] Correctly handle bogusly large chunk sizes
>
>This fixes a denial of service attack vector where bogusly large chunk
>sizes in requests could be used to force restarts of the Varnish
>server.
>
>This is Varnish Security Vulnerability VSV00001
>
>For more information visit: https://varnish-cache.org/security/VSV00001
>
>Fixes: #2379
>---
> bin/varnishd/http1/cache_http1_vfp.c |  2 +-
> bin/varnishtest/tests/f00001.vtc     | 41 ++++++++++++++++++++++++++++++++++++
> 2 files changed, 42 insertions(+), 1 deletion(-)
> create mode 100644 bin/varnishtest/tests/f00001.vtc
>
>diff --git a/bin/varnishd/http1/cache_http1_vfp.c b/bin/varnishd/http1/cache_http1_vfp.c
>index 715a110..e57262c 100644
>--- a/bin/varnishd/http1/cache_http1_vfp.c
>+++ b/bin/varnishd/http1/cache_http1_vfp.c
>@@ -152,7 +152,7 @@ v1f_pull_chunked(struct vfp_ctx *vc, struct vfp_entry *vfe, void *ptr,
> 		if (q == NULL || *q != '\0')
> 			return (VFP_Error(vc, "chunked header number syntax"));
> 		cl = (ssize_t)cll;
>-		if ((uintmax_t)cl != cll)
>+		if (cl < 0 || (uintmax_t)cl != cll)
> 			return (VFP_Error(vc, "bogusly large chunk size"));
> 
> 		vfe->priv2 = cl;
>diff --git a/bin/varnishtest/tests/f00001.vtc b/bin/varnishtest/tests/f00001.vtc
>new file mode 100644
>index 0000000..48af0de
>--- /dev/null
>+++ b/bin/varnishtest/tests/f00001.vtc
>@@ -0,0 +1,41 @@
>+varnishtest "Check that we handle bogusly large chunks correctly"
>+
>+# Check that the bug has been fixed
>+
>+server s1 {
>+	rxreq
>+	txresp
>+} -start
>+
>+varnish v1 -vcl+backend {
>+} -start
>+
>+client c1 {
>+	send "POST / HTTP/1.1\r\n"
>+	send "Transfer-Encoding: chunked\r\n\r\n"
>+	send "FFFFFFFFFFFFFFED\r\n"
>+	send "0\r\n\r\n"
>+
>+	rxresp
>+	expect resp.status == 503
>+} -run
>+
>+# Check that the published workaround does not cause harm
>+
>+varnish v1 -vcl+backend {
>+	sub vcl_recv {
>+		if (req.http.transfer-encoding ~ "(?i)chunked") {
>+			return (fail);
>+		}
>+	}
>+}
>+
>+client c1 {
>+	send "POST / HTTP/1.1\r\n"
>+	send "Transfer-Encoding: chunked\r\n\r\n"
>+	send "FFFFFFFFFFFFFFED\r\n"
>+	send "0\r\n\r\n"
>+
>+	rxresp
>+	expect resp.status == 503
>+} -run
>-- 
>2.1.4
>

Actions: View | Diff

Attachments on bug 1477222: 1307655 | 1307656 | 1307657 | 1307658