|
|
- commit 95cf225d099dcb49eefcf4f5b648be604414ae0c
- Author: Yann Cézard <ycezard@viareport.com>
- Date: Thu Apr 25 14:30:23 2019 +0200
-
- BUG/MEDIUM: contrib/modsecurity: If host header is NULL, don't try to strdup it
-
- I discovered this bug when running OWASP regression tests against HAProxy +
- modsecurity-spoa (it's a POC to evaluate how it is working). I found out that
- modsecurity spoa will crash when the request doesn't have any Host header.
-
- See the pull request #86 on github for details.
-
- This patch must be backported to 1.9 and 1.8.
-
- (cherry picked from commit bf60f6b8033deddc86de5357d6099c7593fe44cc)
- Signed-off-by: Christopher Faulet <cfaulet@haproxy.com>
- (cherry picked from commit d988e3dddcbe1f48f3b24d1bb529fc9ecefde180)
- Signed-off-by: Christopher Faulet <cfaulet@haproxy.com>
-
- diff --git a/contrib/modsecurity/modsec_wrapper.c b/contrib/modsecurity/modsec_wrapper.c
- index 271ec15d..2f3987b4 100644
- --- a/contrib/modsecurity/modsec_wrapper.c
- +++ b/contrib/modsecurity/modsec_wrapper.c
- @@ -325,7 +325,11 @@ int modsecurity_process(struct worker *worker, struct modsecurity_parameters *pa
- req->content_type = apr_table_get(req->headers_in, "Content-Type");
- req->content_encoding = apr_table_get(req->headers_in, "Content-Encoding");
- req->hostname = apr_table_get(req->headers_in, "Host");
- - req->parsed_uri.hostname = chunk_strdup(req, req->hostname, strlen(req->hostname));
- + if (req->hostname != NULL) {
- + req->parsed_uri.hostname = chunk_strdup(req, req->hostname, strlen(req->hostname));
- + } else {
- + req->parsed_uri.hostname = NULL;
- + }
-
- lang = apr_table_get(req->headers_in, "Content-Languages");
- if (lang != NULL) {
|
