From 6eefa71ac0b7e7704339132019c809dc5bb95979 Mon Sep 17 00:00:00 2001 From: Willy Tarreau Date: Tue, 26 May 2026 08:47:11 +0200 Subject: [PATCH] BUG/MINOR: http-ext: always check remaining data when reading rfc7239 nodeport http_7239_extract_nodeport() reads the first byte of the passed string but the caller doesn't check that it's not empty, which can happen if passed as 'host="127.0.0.1:"'. In that case the function would read and return garbage that is present in the buffer after the colon. Let's just check the remaining length before reading. This can be backported to 2.8 as it was introduced with commit b2bb9257d2 ("MINOR: proxy/http_ext: introduce proxy forwarded option"). --- src/http_ext.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/http_ext.c b/src/http_ext.c index a5e862d30..bed876ccc 100644 --- a/src/http_ext.c +++ b/src/http_ext.c @@ -356,7 +356,7 @@ static inline int http_7239_extract_node(struct ist *input, struct forwarded_hea if (!quoted) return 0; /* not supported */ *input = istnext(*input); - if (!http_7239_extract_nodeport(input, nodeport)) + if (!istlen(*input) || !http_7239_extract_nodeport(input, nodeport)) return 0; /* invalid nodeport */ out: /* ok */