From: Martin Mirchev Date: Tue, 27 Oct 2026 02:43:46 +0000 (+0800) Subject: BUG/MINOR: connection: check the NetScaler CIP header length against received data X-Git-Tag: v3.5-dev10~12 X-Git-Url: https://git.kaiwu.me/$%7BGITURL%7D$%7Bcid%7D?a=commitdiff_plain;h=e00364a7b9071679cc6a72021bdd041a00a7cd6a;p=haproxy.git BUG/MINOR: connection: check the NetScaler CIP header length against received data conn_recv_netscaler_cip() only checks that the announced header length is not larger than the whole peeked data, which includes the 8 (legacy) or 12 (standard) byte CIP prefix. The header is then consumed with a single recv() of prefix + hdr_len bytes into the trash chunk. With hdr_len close to tune.bufsize (e.g. 16384 with the default bufsize), this recv() writes up to 12 bytes past the end of the trash buffer. Make sure the announced header fits in the data received after the prefix before going further. CIP is only accepted from trusted peers, so this is not a security issue, but a sender misbehaving that way must not corrupt memory. This should be backported to all stable versions. --- diff --git a/src/connection.c b/src/connection.c index 4b4340724..52fe22038 100644 --- a/src/connection.c +++ b/src/connection.c @@ -1759,6 +1759,12 @@ int conn_recv_netscaler_cip(struct connection *conn, int flag) if (trash.data < 20) goto missing; + /* Fail if the announced header does not fit in what was received, + * since it will be consumed below in a single recv() into the trash. + */ + if (hdr_len > trash.data - (line - trash.area)) + goto missing; + /* Get IP version from the first four bits */ ip_ver = (*line & 0xf0) >> 4;