You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
49 lines
2.1 KiB
49 lines
2.1 KiB
From 3f34b5539e7ba31e44055d853b9ba496e73e0bae Mon Sep 17 00:00:00 2001
|
|
From: Willy Tarreau <w@1wt.eu>
|
|
Date: Mon, 7 Sep 2015 19:32:33 +0200
|
|
Subject: [PATCH 15/16] BUG/MAJOR: http: don't call http_send_name_header()
|
|
after an error
|
|
|
|
A crash was reported when using the "famous" http-send-name-header
|
|
directive. This time it's a bit tricky, it requires a certain number of
|
|
conditions to be met including maxconn on a server, queuing, timeout in
|
|
the queue and cookie-based persistence.
|
|
|
|
The problem is that in stream.c, before calling http_send_name_header(),
|
|
we check a number of conditions to know if we have to replace the header
|
|
name. But prior to reaching this place, it's possible for
|
|
sess_update_stream_int() to fail and change the stream-int's state to
|
|
SI_ST_CLO, send an error 503 to the client, and flush all buffers. But
|
|
http_send_name_header() can only be called with valid buffer contents
|
|
matching the http_msg's description. So when it rewinds the stream to
|
|
modify the header, buf->o becomes negative by the size of the incoming
|
|
request and is used as the argument to memmove() which basically
|
|
displaces 4GB of memory off a few bytes to write the new name, resulting
|
|
in a core and a core file that's really not fun to play with.
|
|
|
|
The solution obviously consists in refraining from calling this nasty
|
|
function when the stream interface is already closed.
|
|
|
|
This bug also affects 1.5 and possibly 1.4, so the fix must be backported
|
|
there.
|
|
(cherry picked from commit 9c03b33329cb4924716edc1c851913a18b0670dc)
|
|
---
|
|
src/session.c | 2 +-
|
|
1 file changed, 1 insertion(+), 1 deletion(-)
|
|
|
|
diff --git a/src/session.c b/src/session.c
|
|
index 6d62e36..7520a85 100644
|
|
--- a/src/session.c
|
|
+++ b/src/session.c
|
|
@@ -2293,7 +2293,7 @@ struct task *process_session(struct task *t)
|
|
|
|
/* Now we can add the server name to a header (if requested) */
|
|
/* check for HTTP mode and proxy server_name_hdr_name != NULL */
|
|
- if ((s->si[1].state >= SI_ST_CON) &&
|
|
+ if ((s->si[1].state >= SI_ST_CON) && (s->si[1].state < SI_ST_CLO) &&
|
|
(s->be->server_id_hdr_name != NULL) &&
|
|
(s->be->mode == PR_MODE_HTTP) &&
|
|
objt_server(s->target)) {
|
|
--
|
|
2.4.6
|
|
|