From fceaefd4d59a3b5d5a4903a3f420e35eb430d0d4 Mon Sep 17 00:00:00 2001 From: Martin Blix Grydeland Date: Fri, 17 Dec 2021 22:10:16 +0100 Subject: [PATCH] Mark req doclose when failing to ignore req body Previously we would ignore errors to iterate the request body into oblivion in VRB_Ignore(), keeping the connection open. This opens an out-of-sync vulnerability on H/1 connections. This patch tests the status of the request body in VRB_Ignore(), marking the request failed and that it should be closed on errors. --- bin/varnishd/cache/cache_req_body.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/bin/varnishd/cache/cache_req_body.c b/bin/varnishd/cache/cache_req_body.c index 6391f928d6..5ffd08b77d 100644 --- a/bin/varnishd/cache/cache_req_body.c +++ b/bin/varnishd/cache/cache_req_body.c @@ -254,6 +254,8 @@ VRB_Ignore(struct req *req) if (req->req_body_status->avail > 0) (void)VRB_Iterate(req->wrk, req->vsl, req, httpq_req_body_discard, NULL); + if (req->req_body_status == BS_ERROR) + req->doclose = SC_RX_BODY; return (0); }