From 226ca1a0ca39efff8277e015f7d2fd12278d8dc5 Mon Sep 17 00:00:00 2001 From: Christopher Faulet Date: Mon, 4 May 2020 09:01:45 +0200 Subject: [PATCH] BUG/MEDIUM: h1: Don't compare host and authority if only h1 headers are parsed When only request headers are parsed, the host header should not be compared to the request authority because no start-line was parsed. Thus there is no authority. Till now this bug was hidden because this parsing mode was only used for the response in the FCGI multiplexer. Since the HTTP checks refactoring, the request headers may now also be parsed without the start-line. This patch fixes the issue #610. It must be backported to 2.1. (cherry picked from commit 7032a3fd0a71426d338190ec0eeb86f5c547c3dd) Signed-off-by: Christopher Faulet --- src/h1.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/h1.c b/src/h1.c index 63fbee8..200364a 100644 --- a/src/h1.c +++ b/src/h1.c @@ -834,7 +834,7 @@ int h1_headers_to_hdr_list(char *start, const char *stop, break; } } - else if (!(h1m->flags & H1_MF_RESP) && isteqi(n, ist("host"))) { + else if (!(h1m->flags & (H1_MF_HDRS_ONLY|H1_MF_RESP)) && isteqi(n, ist("host"))) { if (host_idx == -1) { struct ist authority; -- 1.7.10.4