Visitar URL original
BUG/MINOR: sample: fix NULL dereference in the ltime/utime converters · haproxy/haproxy@b02f937 · GitHub
Skip to content

Commit b02f937

Browse files
Marti2203a-denoyelle
Marti2203
authored and
a-denoyelle
committed
BUG/MINOR: sample: fix NULL dereference in the ltime/utime converters
conv_time_common() returns NULL when alloc_trash_chunk() fails, and when the format string expanded for "%N" does not fit in the trash chunk. Its four callers, sample_conv_us_ltime(), sample_conv_ms_ltime(), sample_conv_us_utime() and sample_conv_ms_utime(), dereference the result without checking it. A configuration using one of these converters with a long format, e.g. ms_ltime("%N%N%N...") expanding to more than bufsize, is accepted by "haproxy -c", and the first request evaluating it crashes the process with a NULL dereference. A failed allocation at runtime has the same effect with an ordinary format. Let's make the converter fail instead, like on its other error paths. This fixes GitHub issue #3545. This must be backported to all stable versions up to 3.0, as commit 5e63e16 introduced the first version of conv_time_common() with a possible NULL return.
1 parent e5e52e3 commit b02f937

1 file changed

Lines changed: 8 additions & 0 deletions

File tree

‎src/sample.c‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2732,6 +2732,8 @@ static int sample_conv_us_ltime(const struct arg *args, struct sample *smp, void
27322732
ns = (date % 1000000) * 1000; /* us part to ns */
27332733

27342734
temp = conv_time_common(args[0].data.str.area, curr_date, ns, 1);
2735+
if (!temp)
2736+
return 0;
27352737
smp->data.u.str = *temp;
27362738
smp->data.type = SMP_T_STR;
27372739
return 1;
@@ -2755,6 +2757,8 @@ static int sample_conv_ms_ltime(const struct arg *args, struct sample *smp, void
27552757
ns = (date % 1000) * 1000000; /* ms part to ns */
27562758

27572759
temp = conv_time_common(args[0].data.str.area, curr_date, ns, 1);
2760+
if (!temp)
2761+
return 0;
27582762
smp->data.u.str = *temp;
27592763
smp->data.type = SMP_T_STR;
27602764
return 1;
@@ -2814,6 +2818,8 @@ static int sample_conv_us_utime(const struct arg *args, struct sample *smp, void
28142818
ns = (date % 1000000) * 1000; /* us part to ns */
28152819

28162820
temp = conv_time_common(args[0].data.str.area, curr_date, ns, 0);
2821+
if (!temp)
2822+
return 0;
28172823
smp->data.u.str = *temp;
28182824
smp->data.type = SMP_T_STR;
28192825
return 1;
@@ -2837,6 +2843,8 @@ static int sample_conv_ms_utime(const struct arg *args, struct sample *smp, void
28372843
ns = (date % 1000) * 1000000; /* ms part to ns */
28382844

28392845
temp = conv_time_common(args[0].data.str.area, curr_date, ns, 0);
2846+
if (!temp)
2847+
return 0;
28402848
smp->data.u.str = *temp;
28412849
smp->data.type = SMP_T_STR;
28422850
return 1;

0 commit comments

Comments
 (0)