upstream/haproxy
1
0
Fork 0
mirror of https://github.com/haproxy/haproxy.git synced 2026-06-11 01:41:49 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions 16

BUG/MINOR: http-fetch: fix smp_fetch_hdr_ip()'s handling of brackets for IPv6

Browse source 
IPv6 addresses can be read enclosed in brackets, but the length of the
string is not checked before checking them. If by lack of luck, the
buffer is empty but already contains '[' in the first place, we'd read
the byte at position -1, possibly crashing (even though in practice it
will not since allocated blocks will be precedeed by the malloc meta-
data). At least it could make asan/valgrind unhappy.

This can be backported to all versions.
This commit is contained in:
Willy Tarreau 2026-05-11 14:56:22 +02:00
parent 009c32d863
commit 15c5226bd3
1 changed files with 1 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
src/http_fetch.c
View file

@ -1100,7 +1100,7 @@ static int smp_fetch_hdr_ip(const struct arg *args, struct sample *smp, const ch
/* IPv4 address suffixed with ':' followed by a valid port number */
smp->data.type = SMP_T_IPV4;
break;
} else if (temp->area[0] == '[' && temp->area[smp->data.u.str.data-1] == ']') {
} else if (smp->data.u.str.data >= 2 && temp->area[0] == '[' && temp->area[smp->data.u.str.data-1] == ']') {
/* IPv6 address enclosed in square brackets */
temp->area[smp->data.u.str.data-1] = '\0';
if (inet_pton(AF_INET6, temp->area+1, &smp->data.u.ipv6)) {