bneradt opened a new pull request, #13650: URL: https://github.com/apache/trafficserver/pull/13650
A header_rewrite configuration line consisting of nothing but a modifier section, such as a stray "[L]", crashes Traffic Server at config load time. The parser consumes the trailing modifiers with a pop_back() and then indexes tokens[0] unconditionally, so an empty token list is read out of bounds. On a hardened build that aborts during plugin init, which takes the whole server down; elsewhere it is a read of a destroyed std::string. Any operator who can write a header_rewrite config can trigger it. This patch guards the token list after the modifier section is consumed. A line with no condition or operator left is not a valid rule, so the parser now reports the offending modifiers with TSError and returns false, which the existing caller already handles by logging the line number and skipping the line. The rest of the config loads normally. This change also adds a unit test covering both a short, small-string optimized modifier token and a longer heap allocated one, plus an end-to-end autest that loads such a config and verifies that Traffic Server starts, logs the rejection, and still applies the surrounding rules. Fixes: #13639 Co-authored-by: Claude Opus 5 -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
