Skip to content

Commit

Permalink
compression: fix overflow when hdr_field contains sanitized body
Browse files Browse the repository at this point in the history
When rebuilding headers for compaction, we cannot shortcut non-compacted headers at assembly time by using raw hdr_field.len for a few reasons: (1) calculated compact buffer len is based on hdr_field.body not hdr_field.len, (2) hdr_field.body is sanitized and may have adjusted len.
  • Loading branch information
john08burke committed Sep 22, 2021
1 parent a5b6d2e commit ba89136
Showing 1 changed file with 13 additions and 26 deletions.
39 changes: 13 additions & 26 deletions modules/compression/compression.c
Original file line number Diff line number Diff line change
Expand Up @@ -91,7 +91,6 @@
#define WORD(p) (*(p + 0) + (*(p + 1) << 8))
#define DWORD(p) (*(p+0) + (*(p+1) << 8) + (*(p+2) << 16) + (*(p+3) << 24))

#define LOWER_CASE(p) (*(p) & 0x20)
#define BUFLEN 4096

#define COMPACT_FORMS "cfiklmstvx"
Expand Down Expand Up @@ -844,31 +843,19 @@ static int mc_compact_cb(char** buf_p, mc_whitelist_p wh_list, int type, int* ol
i = HDR_OTHER_T;
again:
if (hdr_mask[i]) {
/* Compact form name so the header have
to be built */
if (LOWER_CASE(hdr_mask[i]->name.s)) {
/* Copy the name of the header */
wrap_copy_and_update(&new_buf.s,
hdr_mask[i]->name.s,
hdr_mask[i]->name.len, &new_buf.len);

/* Copy the ': ' delimiter*/
wrap_copy_and_update(&new_buf.s, DELIM,
DELIM_LEN, &new_buf.len);
/* Copy the first field of the header*/
wrap_copy_and_update(&new_buf.s,
hdr_mask[i]->body.s,
hdr_mask[i]->body.len, &new_buf.len);
/* Normal form header so it can be copied in one step */
} else {
wrap_copy_and_update(
&new_buf.s,
hdr_mask[i]->name.s,
/* Possible siblings. No CRLF yet */
hdr_mask[i]->len - CRLF_LEN,
&new_buf.len
);
}
/* Copy the name of the header */
wrap_copy_and_update(&new_buf.s,
hdr_mask[i]->name.s,
hdr_mask[i]->name.len, &new_buf.len);

/* Copy the ': ' delimiter*/
wrap_copy_and_update(&new_buf.s, DELIM,
DELIM_LEN, &new_buf.len);

/* Copy the first field of the header*/
wrap_copy_and_update(&new_buf.s,
hdr_mask[i]->body.s,
hdr_mask[i]->body.len, &new_buf.len);

/* Copy the rest of the header fields(siblings)
if they exist */
Expand Down

0 comments on commit ba89136

Please sign in to comment.