29 lines
1.1 KiB
Diff
29 lines
1.1 KiB
Diff
From fceaefd4d59a3b5d5a4903a3f420e35eb430d0d4 Mon Sep 17 00:00:00 2001
|
|
From: Martin Blix Grydeland <martin@varnish-software.com>
|
|
Date: Fri, 17 Dec 2021 22:10:16 +0100
|
|
Subject: [PATCH] Mark req doclose when failing to ignore req body
|
|
|
|
Previously we would ignore errors to iterate the request body into
|
|
oblivion in VRB_Ignore(), keeping the connection open. This opens an
|
|
out-of-sync vulnerability on H/1 connections.
|
|
|
|
This patch tests the status of the request body in VRB_Ignore(), marking
|
|
the request failed and that it should be closed on errors.
|
|
---
|
|
bin/varnishd/cache/cache_req_body.c | 2 ++
|
|
1 file changed, 2 insertions(+)
|
|
|
|
diff --git a/bin/varnishd/cache/cache_req_body.c b/bin/varnishd/cache/cache_req_body.c
|
|
index 6391f928d6..5ffd08b77d 100644
|
|
--- a/bin/varnishd/cache/cache_req_body.c
|
|
+++ b/bin/varnishd/cache/cache_req_body.c
|
|
@@ -254,6 +254,8 @@ VRB_Ignore(struct req *req)
|
|
if (req->req_body_status->avail > 0)
|
|
(void)VRB_Iterate(req->wrk, req->vsl, req,
|
|
httpq_req_body_discard, NULL);
|
|
+ if (req->req_body_status == BS_ERROR)
|
|
+ req->doclose = SC_RX_BODY;
|
|
return (0);
|
|
}
|
|
|