upstream/haproxy
1
0
Fork 0
mirror of https://github.com/haproxy/haproxy.git synced 2026-07-13 02:57:32 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions 5

BUG/MINOR: sample: Fix a possible underflow on be2hex for large chunk size

Browse source 
For a chunk size exactly equal to bufsize/2, the "max_size" variable could
underflow if a separator is provided. Indeed, "max_size" is first set to
(trash->size - 2 * chunk_size), so to 0. And on the first iteration, the
separator length is removed, making it to underflow.

On 3.3 and lower it is especially an issue with samples larger than
bufsize/2 because data could be written ouside of the buffer. On 3.4 and
3.5, it is not an issue because we fail to retrieve a chunk.

This should be backported to all supported versions.
This commit is contained in:
Christopher Faulet 2026-07-07 14:13:49 +02:00
parent e528442847
commit ee5cfaf266
1 changed files with 1 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
src/sample.c
View file

@ -2162,7 +2162,7 @@ static int sample_conv_be2hex(const struct arg *args, struct sample *smp, void *
trash->data = 0;
if (args[0].data.str.data == 0 && args[2].data.sint == 0)
chunk_size = smp->data.u.str.data;
if (2 * (size_t)chunk_size > trash->size)
if (2 * (size_t)chunk_size + args[0].data.str.data > trash->size)
return 0;
max_size = trash->size - 2 * (size_t)chunk_size;