Skip to content

proxy_protocol: fix off-by-one stack buffer overflow in PROXY v1 head…#4998

Open
uwezkhan wants to merge 1 commit intoMariaDB:bb-10.11-midenok-MDEV-25529from
uwezkhan:fix/proxy-header-overflow-10.11
Open

proxy_protocol: fix off-by-one stack buffer overflow in PROXY v1 head…#4998
uwezkhan wants to merge 1 commit intoMariaDB:bb-10.11-midenok-MDEV-25529from
uwezkhan:fix/proxy-header-overflow-10.11

Conversation

@uwezkhan
Copy link
Copy Markdown

The header parsing loop could append a null terminator past the end of
the buffer when processing maximum-length PROXY v1 headers.

Fix by increasing the buffer size by one byte and using bounded reads
while preserving full header parsing.

Treat zero-length reads as connection close in this context.

Add a regression test for maximum-length PROXY headers.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Development

Successfully merging this pull request may close these issues.

1 participant