From 77f233a4840afb8b081d12b083b19ed314fd975a Mon Sep 17 00:00:00 2001
From: Matthew Holt <mholt@users.noreply.github.com>
Date: Tue, 30 Jun 2020 11:42:55 -0600
Subject: [PATCH] caddyhttp: Corrected host label index check (fix #3502)

---
 modules/caddyhttp/replacer.go      | 2 +-
 modules/caddyhttp/replacer_test.go | 4 ++++
 2 files changed, 5 insertions(+), 1 deletion(-)

diff --git a/modules/caddyhttp/replacer.go b/modules/caddyhttp/replacer.go
index b3c7b5dc..f5950211 100644
--- a/modules/caddyhttp/replacer.go
+++ b/modules/caddyhttp/replacer.go
@@ -172,7 +172,7 @@ func addHTTPVarsToReplacer(repl *caddy.Replacer, req *http.Request, w http.Respo
 					reqHost = req.Host // OK; assume there was no port
 				}
 				hostLabels := strings.Split(reqHost, ".")
-				if idx > len(hostLabels) {
+				if idx >= len(hostLabels) {
 					return "", true
 				}
 				return hostLabels[len(hostLabels)-idx-1], true
diff --git a/modules/caddyhttp/replacer_test.go b/modules/caddyhttp/replacer_test.go
index bc18c5a0..49167ee5 100644
--- a/modules/caddyhttp/replacer_test.go
+++ b/modules/caddyhttp/replacer_test.go
@@ -107,6 +107,10 @@ eqp31wM9il1n+guTNyxJd+FzVAH+hCZE5K+tCgVDdVFUlDEHHbS/wqb2PSIoouLV
 			input:  "{http.request.host.labels.1}",
 			expect: "example",
 		},
+		{
+			input:  "{http.request.host.labels.2}",
+			expect: "<empty>",
+		},
 		{
 			input:  "{http.request.tls.cipher_suite}",
 			expect: "TLS_AES_256_GCM_SHA384",