You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
36 lines
1.7 KiB
36 lines
1.7 KiB
commit 95cf225d099dcb49eefcf4f5b648be604414ae0c
|
|
Author: Yann Cézard <ycezard@viareport.com>
|
|
Date: Thu Apr 25 14:30:23 2019 +0200
|
|
|
|
BUG/MEDIUM: contrib/modsecurity: If host header is NULL, don't try to strdup it
|
|
|
|
I discovered this bug when running OWASP regression tests against HAProxy +
|
|
modsecurity-spoa (it's a POC to evaluate how it is working). I found out that
|
|
modsecurity spoa will crash when the request doesn't have any Host header.
|
|
|
|
See the pull request #86 on github for details.
|
|
|
|
This patch must be backported to 1.9 and 1.8.
|
|
|
|
(cherry picked from commit bf60f6b8033deddc86de5357d6099c7593fe44cc)
|
|
Signed-off-by: Christopher Faulet <cfaulet@haproxy.com>
|
|
(cherry picked from commit d988e3dddcbe1f48f3b24d1bb529fc9ecefde180)
|
|
Signed-off-by: Christopher Faulet <cfaulet@haproxy.com>
|
|
|
|
diff --git a/contrib/modsecurity/modsec_wrapper.c b/contrib/modsecurity/modsec_wrapper.c
|
|
index 271ec15d..2f3987b4 100644
|
|
--- a/contrib/modsecurity/modsec_wrapper.c
|
|
+++ b/contrib/modsecurity/modsec_wrapper.c
|
|
@@ -325,7 +325,11 @@ int modsecurity_process(struct worker *worker, struct modsecurity_parameters *pa
|
|
req->content_type = apr_table_get(req->headers_in, "Content-Type");
|
|
req->content_encoding = apr_table_get(req->headers_in, "Content-Encoding");
|
|
req->hostname = apr_table_get(req->headers_in, "Host");
|
|
- req->parsed_uri.hostname = chunk_strdup(req, req->hostname, strlen(req->hostname));
|
|
+ if (req->hostname != NULL) {
|
|
+ req->parsed_uri.hostname = chunk_strdup(req, req->hostname, strlen(req->hostname));
|
|
+ } else {
|
|
+ req->parsed_uri.hostname = NULL;
|
|
+ }
|
|
|
|
lang = apr_table_get(req->headers_in, "Content-Languages");
|
|
if (lang != NULL) {
|