BUG/MINOR: connection: check the NetScaler CIP header length against received data

conn_recv_netscaler_cip() only checks that the announced header length
<hdr_len> is not larger than the whole peeked data, which includes the
8 (legacy) or 12 (standard) byte CIP prefix. The header is then consumed
with a single recv() of prefix + hdr_len bytes into the trash chunk. With
hdr_len close to tune.bufsize (e.g. 16384 with the default bufsize), this
recv() writes up to 12 bytes past the end of the trash buffer.

Make sure the announced header fits in the data received after the prefix
before going further.

CIP is only accepted from trusted peers, so this is not a security issue,
but a sender misbehaving that way must not corrupt memory.

This should be backported to all stable versions.

diff --git a/src/connection.c b/src/connection.c
index 4b4340724fbd8b2a0cdba438aaab1cbf4e2f9b7a..52fe22038e0f58b10ee8721c17afc6964a6f0cc3 100644 (file)
--- a/src/connection.c
+++ b/src/connection.c
@@ -1759,6 +1759,12 @@ int conn_recv_netscaler_cip(struct connection *conn, int flag)
        if (trash.data < 20)
                goto missing;
 
+       /* Fail if the announced header does not fit in what was received,
+        * since it will be consumed below in a single recv() into the trash.
+        */
+       if (hdr_len > trash.data - (line - trash.area))
+               goto missing;
+
        /* Get IP version from the first four bits */
        ip_ver = (*line & 0xf0) >> 4;