BUG/MEDIUM: cli: Don't parse next command if input buffer is empty

In the loop of the command line parser, we always tried to get the next
command, even when the input buffer was empty. However it was an issue if
the size of command line was exactly the buffer size and it was finished by
a payload pattern. In that case, an attempt to allocate a dynamic buffer for
the payload was performed with a size of 0, which led to a crash.

To fix the issue, the loop is now interrupted with there is no more data to
parse in the input buffer. This way, when an dynamic buffer must be
(re)allocated, we are sure its size will never be 0. To be sure it is true,
a BUG_ON() was added on the new dynamic buffer size.

To mitigate the issue, "tune.cli.max-payload-size" parameter can be set to
0.

This patch must be backported to 3.4.

diff --git a/src/cli.c b/src/cli.c
index 73a1df94ccd109b98f5171d8d677dc5c99131c1f..fafad7c83c3dd9a60d640284d098951f424dae25 100644 (file)
--- a/src/cli.c
+++ b/src/cli.c
@@ -1009,6 +1009,8 @@ int cli_try_realloc_payload(struct appctx *appctx, struct buffer *buf, size_t ne
 {
        char *old, *new;
 
+       BUG_ON(new_size == 0);
+
        if (new_size > appctx->cli_ctx.max_payload_sz)
                new_size = appctx->cli_ctx.max_payload_sz;
 
@@ -1049,6 +1051,9 @@ int cli_parse_cmdline(struct appctx *appctx)
        while (1) {
                struct buffer *buf;
 
+               if (!b_data(&appctx->inbuf))
+                       break;
+
                /* payload doesn't take escapes nor does it end on semi-colons,
                 * so we use the regular getline. Normal mode however must stop
                 * on LFs and semi-colons that are not prefixed by a backslash.