SABITHSAHEB opened a new pull request, #13900: URL: https://github.com/apache/trafficserver/pull/13900
1. `TSRemapDoRemap` builds the string to verify by appending each URL part that the client's `P=` value selects to the stack buffer `signed_part`, then overwrites the trailing `/` with `signed_part[strlen(signed_part) - 1]`. With `P=0` nothing gets appended, `strlen - 1` wraps, and one byte (`?` for the query form, `\0` for the path-parameter form) is written just before `signed_part`. 2. This runs before the HMAC check. A request with a future `E=`, any configured `K=`, `A=1`/`2`, `P=0` and an `S=` of the right length is enough, e.g. `/foo?E=33046618506&A=1&K=7&P=0&S=<40 hex chars>`. Running the extracted reconstruction loop under ASan reports `stack-buffer-underflow ... WRITE of size 1` on `signed_part`. 3. Clamped the index to 0 when `signed_part` is empty. For `P=0` the verifier now rebuilds `?E=...&S=`, the same string `sign.pl` signs, so URLs signed with `--useparts 0` verify. Behavior when `P` selects one or more parts is unchanged. Added a `P=0` case to the url_sig uranium test. It fails without the fix because the reconstructed string loses its leading `?`. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
