bryancall opened a new issue, #13639: URL: https://github.com/apache/trafficserver/issues/13639
## Summary `Parser::preprocess()` in header_rewrite can pop the only token off the vector and then index `tokens[0]` without checking whether anything is left. ## Detail [`plugins/header_rewrite/parser.cc:194`](https://github.com/apache/trafficserver/blob/master/plugins/header_rewrite/parser.cc#L194) consumes a trailing flags section: ```cpp if (tokens.size() > 0) { std::string m = tokens[tokens.size() - 1]; if (!m.empty() && (m[0] == '[')) { if (m[m.size() - 1] == ']') { ... tokens.pop_back(); // consume it, so we don't concatenate it into the value } else { ... } } } // Special case for "conditional" values if (tokens[0].substr(0, 2) == "%{") { ``` A configuration line whose only token is a flags section, `[L]` on a line by itself for instance, gives `tokens.size() == 1`. The `pop_back()` empties the vector, and the very next statement indexes `tokens[0]`. `std::vector::operator[]` does no bounds checking, so this is an out-of-bounds read on a configuration file that a user can write. ## Proposed fix An `if (tokens.empty())` guard after the `pop_back()`, returning `false` with a `TSError` describing the offending line. A flags-only line is not a valid rule, so rejecting it with a message beats reading past the end of the vector. ## Context Pre-existing, and adjacent to a hunk in [PR #13591](https://github.com/apache/trafficserver/pull/13591). Filing it separately to keep that PR purely mechanical. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
