Fix out-of-bounds access.

Obtained from:	upstream

1 files changed, 60 insertions, 0 deletions

diff --git a/net/haproxy/files/patch-fix-outofbounds b/net/haproxy/files/patch-fix-outofbounds
new file mode 100644
index 000000000000..424ab013f15c
--- /dev/null
+++ b/net/haproxy/files/patch-fix-outofbounds
@@ -0,0 +1,60 @@
+diff --git a/include/common/hpack-tbl.h b/include/common/hpack-tbl.h
+index ffa866b..385f386 100644
+--- include/common/hpack-tbl.h
++++ include/common/hpack-tbl.h
+@@ -155,7 +155,7 @@ static inline const struct hpack_dte *hpack_get_dte(const struct hpack_dht *dht,
+ }
+ 
+ /* returns non-zero if <idx> is valid for table <dht> */
+-static inline int hpack_valid_idx(const struct hpack_dht *dht, uint16_t idx)
++static inline int hpack_valid_idx(const struct hpack_dht *dht, uint32_t idx)
+ {
+ 	return idx < dht->used + HPACK_SHT_SIZE;
+ }
+@@ -181,7 +181,7 @@ static inline struct ist hpack_get_value(const struct hpack_dht *dht, const stru
+ }
+ 
+ /* takes an idx, returns the associated name */
+-static inline struct ist hpack_idx_to_name(const struct hpack_dht *dht, int idx)
++static inline struct ist hpack_idx_to_name(const struct hpack_dht *dht, uint32_t idx)
+ {
+ 	const struct hpack_dte *dte;
+ 
+@@ -196,7 +196,7 @@ static inline struct ist hpack_idx_to_name(const struct hpack_dht *dht, int idx)
+ }
+ 
+ /* takes an idx, returns the associated value */
+-static inline struct ist hpack_idx_to_value(const struct hpack_dht *dht, int idx)
++static inline struct ist hpack_idx_to_value(const struct hpack_dht *dht, uint32_t idx)
+ {
+ 	const struct hpack_dte *dte;
+ 
+diff --git a/src/hpack-dec.c b/src/hpack-dec.c
+index dfbcaff..99d40f9 100644
+--- src/hpack-dec.c
++++ src/hpack-dec.c
+@@ -110,7 +110,7 @@ static inline int hpack_idx_to_phdr(uint32_t idx)
+  * allocated there. In case of allocation failure, returns a string whose
+  * pointer is NULL.
+  */
+-static inline struct ist hpack_alloc_string(struct chunk *store, int idx, struct ist in)
++static inline struct ist hpack_alloc_string(struct chunk *store, uint32_t idx, struct ist in)
+ {
+ 	struct ist out;
+ 
+diff --git a/src/hpack-tbl.c b/src/hpack-tbl.c
+index 9d6b764..e2d4426 100644
+--- src/hpack-tbl.c
++++ src/hpack-tbl.c
+@@ -113,7 +113,7 @@ static inline unsigned int hpack_dht_get_tail(const struct hpack_dht *dht)
+ /* dump the whole dynamic header table */
+ static void hpack_dht_dump(const struct hpack_dht *dht)
+ {
+-	int i;
++	unsigned int i;
+ 	unsigned int slot;
+ 	char name[4096], value[4096];
+ 
+-- 
+1.7.12.1
+