Attachment 731037 Details for Bug 947581 – haproxy-CVE-2013-1912-request-buffers.patch

[patch] haproxy-CVE-2013-1912-request-buffers.patch

haproxy-CVE-2013-1912-request-buffers.patch (text/plain), 1.80 KB, created by Kurt Seifried on 2013-04-03 03:44:59 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Kurt Seifried

Created: 2013-04-03 03:44:59 UTC

Size: 1.80 KB

patch

obsolete

>diff --git a/src/proto_http.c b/src/proto_http.c
>index a52c038..a768eb5 100644 (file)
>--- a/src/proto_http.c
>+++ b/src/proto_http.c
>@@ -8347,6 +8347,14 @@ acl_fetch_proto_http(struct proxy *px, struct session *s, void *l7, int dir,
>                return 1;
>        }
> 
>+       /* If the buffer does not leave enough free space at the end,
>+        * we must first realign it.
>+        */
>+       if (unlikely(req->lr > req->data &&
>+           (req->r < req->lr || req->r > req->data + req->size - global.tune.maxrewrite)) &&
>+           (req->l <= req->size - global.tune.maxrewrite))
>+               http_buffer_heavy_realign(req, msg);
>+
>        /* Try to decode HTTP request */
>        if (likely(req->lr < req->r))
>                http_msg_analyzer(req, msg, &txn->hdr_idx);
>@@ -8364,6 +8372,20 @@ acl_fetch_proto_http(struct proxy *px, struct session *s, void *l7, int dir,
>        /* OK we got a valid HTTP request. We have some minor preparation to
>         * perform so that further checks can rely on HTTP tests.
>         */
>+
>+       /* If the request was parsed but was too large, we must absolutely
>+        * return an error so that it is not processed. At the moment this
>+        * cannot happen, but if the parsers are to change in the future,
>+        * we want this check to be maintained.
>+        */
>+       if (unlikely(req->lr > req->data &&
>+           (req->r < req->lr || req->l > req->size - global.tune.maxrewrite ||
>+            req->r > req->data + req->size - global.tune.maxrewrite))) {
>+               msg->msg_state = HTTP_MSG_ERROR;
>+               test->flags |= ACL_TEST_F_SET_RES_PASS;
>+               return 1;
>+       }
>+
>        txn->meth = find_http_meth(msg->sol, msg->sl.rq.m_l);
>        if (txn->meth == HTTP_METH_GET || txn->meth == HTTP_METH_HEAD)
>                s->flags |= SN_REDIRECTABLE;
>

Actions: View | Diff

Attachments on bug 947581: 731037