Merge ccdecfd832 into 932c4e3fd9

ss pointed into the buf request buffer and was never updated when buf
was realloc()ed while reading request headers (both in the header loop
and in handlehdrfilterscli()). The ftp:// branch then dereferenced the
stale pointer.

Store ss as an offset into buf and recompute it before use.

Requires authenticated access to proxy or configuration with
authentication disabled.

Reported by Calif.io in collaboration with Anthropic
(ref ANT-2026-FHVKZ7VQ).

README.md

@@ -18,6 +18,9 @@ https://github.com/3proxy/3proxy/releases
 https://hub.docker.com/r/3proxy/3proxy
 https://github.com/3proxy/3proxy/pkgs/container/3proxy
 
+> [!TIP]
+> An alternative Docker image (community-maintained) with support for configuration through environment variables and a ready-to-use Helm chart for Kubernetes can be found here: [tarampampam/3proxy-docker](https://github.com/tarampampam/3proxy-docker).
+
 ### Archive of old versions
 
 https://github.com/z3APA3A/3proxy-archive

src/proxy.c

@@ -247,6 +247,7 @@ void * proxychild(struct clientparam* param) {
  int redirect = 0;
  int prefix = 0, ckeepalive=0;
  int ftp = 0;
+ int ssoff = 0;
 #ifndef ANONYMOUS
  int anonymous;
 #endif
@@ -338,6 +339,7 @@ for(;;){
 
  if ((sb=(unsigned char *)(unsigned char *)strchr((char *)buf, ' ')) == NULL) {RETURN(512);}
  ss = ++sb;
+ ssoff = (int)(ss - buf);
  if(!isconnect) {
 	if (!strncasecmp((char *)sb, "http://", 7)) {
 		sb += 7;
@@ -640,6 +642,7 @@ for(;;){
 	ckeepalive = 1;
 	if(ftpbase) free(ftpbase);
 	ftpbase = NULL;
+	ss = buf + ssoff;
 	if(!(sp = (unsigned char *)strchr((char *)ss, ' '))){RETURN(799);}
 	*sp = 0;