upstream/haproxy
1
0
Fork 0
mirror of https://github.com/haproxy/haproxy.git synced 2026-04-10 11:26:15 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions 12

BUG/MINOR: http-act: validate decoded lengths in *-headers-bin

Browse source 
http_action_set_headers_bin() decodes varint name and value lengths
from a binary sample but never validates that the decoded length
fits in the remaining sample data before constructing the ist.

If the value's varint decodes to a large number with only a few
bytes following, v.len exceeds the buffer and http_add_header()
memcpys past the sample, copying adjacent heap data into a header
sent to the backend (or client, with http-response).

The intended source for this action is the hdrs_bin sample fetch
which produces well-formed output, but nothing prevents an admin
from feeding it req.body or another untrusted source. With:

    http-request set-var(txn.h) req.body
    http-request add-headers-bin var(txn.h)

a POST body of [05]"X-Foo"[c8]"AB" produces v = {ptr="AB", len=200}
and 198 bytes of adjacent heap data go into X-Foo.

http_action_del_headers_bin() was fixed too.

Compare spoe_decode_buffer() which has the equivalent check.
Validate both name and value lengths against remaining data.

No backport needed.
This commit is contained in:
Greg Kroah-Hartman 2026-04-09 13:06:45 +02:00 committed by Christopher Faulet
parent bd03f05007
commit 0cde3cd4df
1 changed files with 6 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

6
src/http_act.c
View file

@ -1511,11 +1511,15 @@ static enum act_return http_action_set_headers_bin(struct act_rule *rule, struct
goto leave;
}
if (sz > (uint64_t)(end - p))
goto fail_rewrite;
n = ist2(p, sz);
p += sz;
if (decode_varint(&p, end, &sz) == -1)
goto fail_rewrite;
if (sz > (uint64_t)(end - p))
goto fail_rewrite;
v = ist2(p, sz);
p += sz;
@ -1935,6 +1939,8 @@ static enum act_return http_action_del_headers_bin(struct act_rule *rule, struct
goto fail_rewrite;
if (!sz)
goto leave;
if (sz > (uint64_t)(end - p))
goto fail_rewrite;
n = ist2(p, sz);
p += sz;