varnish/CVE-2022-45059-pre.patch
2023-12-12 15:36:52 +08:00

33 lines
1.1 KiB
Diff

From 0fb3baff7963604a55be0ed6ebdf1e4654ead219 Mon Sep 17 00:00:00 2001
From: Martin Blix Grydeland <martin@varnish-software.com>
Date: Thu, 4 Aug 2022 11:04:37 +0200
Subject: [PATCH] Clean up assertions in http_hdr_flags()
Origin: https://github.com/varnishcache/varnish-cache/commit/0fb3baff7963604a55be0ed6ebdf1e4654ead219
The input argument assertions and checks in http_hdr_flags() were
misleading and lacking. With this patch it returns (NULL) on either input
being NULL, and also when called with an empty string instead of
asserting.
---
bin/varnishd/cache/cache_http.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/bin/varnishd/cache/cache_http.c b/bin/varnishd/cache/cache_http.c
index 3f5ee0384a..194055c3ca 100644
--- a/bin/varnishd/cache/cache_http.c
+++ b/bin/varnishd/cache/cache_http.c
@@ -140,9 +140,9 @@ http_hdr_flags(const char *b, const char *e)
unsigned u;
struct http_hdrflg *retval;
- if (e == NULL)
- return(NULL);
- assert(e > b);
+ if (b == NULL || e == NULL)
+ return (NULL);
+ assert(b <= e);
u = (unsigned)(e - b);
assert(b + u == e);
if (u < 2 || u > 19) // MIN_WORD_LENGTH & MAX_WORD_LENGTH