SIGN IN SIGN UP

BUG/MINOR: http-act: work on a copy of the sample in del-headers-bin

http_action_del_headers_bin() walks the varint-encoded list of header names
directly in the sample expression result:

	p = b_orig(&hdrs_bin->data.u.str);
	end = b_tail(&hdrs_bin->data.u.str);

and uses the names it decodes there while calling http_remove_header() on the
HTX message in between. But the sample may perfectly well point into that very
message: a string sample is cast to a binary one in place, so an expression such
as "req.hdr(x-list)" hands out a pointer inside the header block it describes.
http_remove_header() memmoves the payload of the block it shortens and marks the
blocks it removes as unused, so <p>, <end> and <n> may then designate stale or
recycled bytes and the loop goes on deleting names decoded from garbage. The
header value must be a valid varint-encoded list for this to happen, which is
possible since only NUL, CR and LF are rejected in an H1 header value.

This is the exact same problem as the one fixed for the sibling actions by
commit 43932db85 ("BUG/MEDIUM: http-act: Make a copy of the sample expr in
(set/add)-headers-bin"), which this action was left out of. Let's copy the
sample into a private chunk the same way before decoding it.

This should be backported to 3.4, like the commit above.
W
Willy Tarreau committed
be9e357f903fbf1aaf6fef70f87f19d8224a3606
Parent: 0b329bb
Committed by Christopher Faulet <cfaulet@haproxy.com> on 7/27/2026, 1:31:18 PM