|
 |
4834bd |
From 0980912282f20a1db64d7ba0a9a825dfee3cb044 Mon Sep 17 00:00:00 2001
|
|
|
4834bd |
From: Andrew McDermott <aim@frobware.com>
|
|
|
4834bd |
Date: Fri, 11 Feb 2022 18:26:49 +0000
|
|
|
4834bd |
Subject: [PATCH] BUG/MAJOR: http/htx: prevent unbounded loop in
|
|
|
4834bd |
http_manage_server_side_cookies
|
|
|
4834bd |
|
|
|
4834bd |
Ensure calls to http_find_header() terminate. If a "Set-Cookie2"
|
|
|
4834bd |
header is found then the while(1) loop in
|
|
|
4834bd |
http_manage_server_side_cookies() will never terminate, resulting in
|
|
|
4834bd |
the watchdog firing and the process terminating via SIGABRT.
|
|
|
4834bd |
|
|
|
4834bd |
The while(1) loop becomes unbounded because an unmatched call to
|
|
|
4834bd |
http_find_header("Set-Cookie") will leave ctx->blk=NULL. Subsequent
|
|
|
4834bd |
calls to check for "Set-Cookie2" will now enumerate from the beginning
|
|
|
4834bd |
of all the blocks and will once again match on subsequent
|
|
|
4834bd |
passes (assuming a match first time around), hence the loop becoming
|
|
|
4834bd |
unbounded.
|
|
|
4834bd |
|
|
|
4834bd |
This issue was introduced with HTX and this fix should be backported
|
|
|
4834bd |
to all versions supporting HTX.
|
|
|
4834bd |
|
|
|
4834bd |
Many thanks to Grant Spence (gspence@redhat.com) for working through
|
|
|
4834bd |
this issue with me.
|
|
|
4834bd |
|
|
|
4834bd |
(cherry picked from commit bfb15ab34ead85f64cd6da0e9fb418c9cd14cee8)
|
|
|
4834bd |
Signed-off-by: Willy Tarreau <w@1wt.eu>
|
|
|
4834bd |
(cherry picked from commit d8ce72f63e115fa0952e6a58e81c3d15dfc0a509)
|
|
|
4834bd |
Signed-off-by: Willy Tarreau <w@1wt.eu>
|
|
|
4834bd |
---
|
|
|
4834bd |
src/http_ana.c | 2 +-
|
|
|
4834bd |
1 file changed, 1 insertion(+), 1 deletion(-)
|
|
|
4834bd |
|
|
|
4834bd |
diff --git a/src/http_ana.c b/src/http_ana.c
|
|
|
4834bd |
index 4c765cb39..0f40ab3ab 100644
|
|
|
4834bd |
--- a/src/http_ana.c
|
|
|
4834bd |
+++ b/src/http_ana.c
|
|
|
4834bd |
@@ -3433,7 +3433,7 @@ static void http_manage_server_side_cookies(struct stream *s, struct channel *re
|
|
|
4834bd |
while (1) {
|
|
|
4834bd |
int is_first = 1;
|
|
|
4834bd |
|
|
|
4834bd |
- if (!http_find_header(htx, ist("Set-Cookie"), &ctx, 1)) {
|
|
|
4834bd |
+ if (is_cookie2 || !http_find_header(htx, ist("Set-Cookie"), &ctx, 1)) {
|
|
|
4834bd |
if (!http_find_header(htx, ist("Set-Cookie2"), &ctx, 1))
|
|
|
4834bd |
break;
|
|
|
4834bd |
is_cookie2 = 1;
|
|
|
4834bd |
--
|
|
|
4834bd |
2.33.1
|
|
|
4834bd |
|