Check if `HTTP_X_AMZ_COPY_SOURCE` header is empty
authorSuyash Dongre <suyashd999@gmail.com>
Wed, 20 Aug 2025 17:52:41 +0000 (23:22 +0530)
committerSalvatore Bonaccorso <carnil@debian.org>
Sat, 16 May 2026 12:52:24 +0000 (14:52 +0200)
commitcd16ac84fb36098a2d4fe4e898d134c8c59d9b25
tree198a9bd9622293139adad865fb89c2714e1c7f22
parent1b7e5bce0e91392e70b0dd6d6ed51d5b6e0a3f15
Check if `HTTP_X_AMZ_COPY_SOURCE` header is empty

Origin: https://github.com/ceph/ceph/commit/bef59f17293e6e93af025eba1e00646d0b1a2bf0
Bug-Debian: https://bugs.debian.org/1120797
Bug-Debian-Security: https://security-tracker.debian.org/tracker/CVE-2024-47866

The issue was that the `HTTP_X_AMZ_COPY_SOURCE` header could be present but empty (i.e., an empty string rather than NULL). The  code only checked if the pointer was not NULL, but didn't verify that the string had content. When an empty string was passed to RGWCopyObj::parse_copy_location(), it would eventually try to access name_str[0] on an empty string, causing a crash.

Fixes: https://tracker.ceph.com/issues/72669
Signed-off-by: Suyash Dongre <suyashd999@gmail.com>
Gbp-Pq: Name Check-if-HTTP_X_AMZ_COPY_SOURCE-header-is-empty.patch
src/rgw/rgw_op.cc