You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

55 lines
1.8 KiB

  1. commit bf7b382e528ab62a9f695b07e659d2f77545e93d
  2. Author: Frédéric Lécaille <flecaille@haproxy.com>
  3. Date: Thu Oct 25 20:17:45 2018 +0200
  4. BUG/MINOR: cache: Crashes with "total-max-size" > 2047(MB).
  5. With this patch we support cache size larger than 2047 (MB) and prevent haproxy from crashing when "total-max-size" is parsed as negative values by atoi().
  6. The limit at parsing time is 4095 MB (UINT_MAX >> 20).
  7. May be backported to 1.8.
  8. (cherry picked from commit b9b8b6b6beb84b6b942d24eda56bfbe3812cc294)
  9. Signed-off-by: Willy Tarreau <w@1wt.eu>
  10. diff --git a/src/cache.c b/src/cache.c
  11. index 39e0bad4..df3649ea 100644
  12. --- a/src/cache.c
  13. +++ b/src/cache.c
  14. @@ -770,17 +770,32 @@ int cfg_parse_cache(const char *file, int linenum, char **args, int kwm)
  15. tmp_cache_config->maxblocks = 0;
  16. }
  17. } else if (strcmp(args[0], "total-max-size") == 0) {
  18. - int maxsize;
  19. + unsigned long int maxsize;
  20. + char *err;
  21. if (alertif_too_many_args(1, file, linenum, args, &err_code)) {
  22. err_code |= ERR_ABORT;
  23. goto out;
  24. }
  25. + maxsize = strtoul(args[1], &err, 10);
  26. + if (err == args[1] || *err != '\0') {
  27. + ha_warning("parsing [%s:%d]: total-max-size wrong value '%s'\n",
  28. + file, linenum, args[1]);
  29. + err_code |= ERR_ABORT;
  30. + goto out;
  31. + }
  32. +
  33. + if (maxsize > (UINT_MAX >> 20)) {
  34. + ha_warning("parsing [%s:%d]: \"total-max-size\" (%s) must not be greater than %u\n",
  35. + file, linenum, args[1], UINT_MAX >> 20);
  36. + err_code |= ERR_ABORT;
  37. + goto out;
  38. + }
  39. +
  40. /* size in megabytes */
  41. - maxsize = atoi(args[1]) * 1024 * 1024 / CACHE_BLOCKSIZE;
  42. + maxsize *= 1024 * 1024 / CACHE_BLOCKSIZE;
  43. tmp_cache_config->maxblocks = maxsize;
  44. -
  45. } else if (strcmp(args[0], "max-age") == 0) {
  46. if (alertif_too_many_args(1, file, linenum, args, &err_code)) {
  47. err_code |= ERR_ABORT;