Le 09/04/2026 à 1:06 PM, Greg Kroah-Hartman a écrit :
http_action_set_headers_bin() decodes varint name and value lengths from a binary sample but never validates that the decoded length fits in the remaining sample data before constructing the ist.If the value's varint decodes to a large number with only a few bytes following, v.len exceeds the buffer and http_add_header() memcpys past the sample, copying adjacent heap data into a header sent to the backend (or client, with http-response). The intended source for this action is the hdrs_bin sample fetch which produces well-formed output, but nothing prevents an admin from feeding it req.body or another untrusted source. With: http-request set-var(txn.h) req.body http-request add-headers-bin var(txn.h) a POST body of [05]"X-Foo"[c8]"AB" produces v = {ptr="AB", len=200} and 198 bytes of adjacent heap data go into X-Foo. Compare spoe_decode_buffer() which has the equivalent check. Validate both name and value lengths against remaining data. --- src/http_act.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/src/http_act.c b/src/http_act.c index 57e390b3fb8e..90a957b9764c 100644 --- a/src/http_act.c +++ b/src/http_act.c @@ -1511,11 +1511,15 @@ static enum act_return http_action_set_headers_bin(struct act_rule *rule, struct goto leave; }+ if (sz > (uint64_t)(end - p))+ goto fail_rewrite; n = ist2(p, sz); p += sz;if (decode_varint(&p, end, &sz) == -1)goto fail_rewrite; + if (sz > (uint64_t)(end - p)) + goto fail_rewrite;v = ist2(p, sz);p += sz;
Merged, thanks. I amended the patch to fix http_action_del_headers_bin() accordingly.
-- Christopher Faulet
