tree be8c477d54af935bac2ecd04ecbda432bbd7525b
parent 0b77c18740843a28750a9e79a84b0df998826c7b
author Christopher Faulet <cfaulet@haproxy.com> 1593535952 +0200
committer Christopher Faulet <cfaulet@haproxy.com> 1594129823 +0200

BUG/MEDIUM: pattern: Add a trailing \0 to match strings only if possible

In pat_match_str() and pat_math_beg() functions, a trailing zero is
systematically added at the end of the string, even if the buffer is not large
enough to accommodate it. It is a possible buffer overflow. For instance, when
the alpn is matched against a list of strings, the sample fetch is filled with a
non-null terminated string returned by the SSL library. No trailing zero must be
added at the end of this string, because it is outside the buffer.

So, to fix the bug, a trailing zero is added only if the buffer is large enough
to accommodate it. Otherwise, the sample fetch is duplicated. smp_dup() function
adds a trailing zero to the duplicated string, truncating it if it is too long.

This patch should fix the issue #718. It must be backported to all supported
versions.

(cherry picked from commit b4cf7ab9bc413bbb956e225f903959bff17e4049)
Signed-off-by: Christopher Faulet <cfaulet@haproxy.com>
(cherry picked from commit 37790a22a7d1ff27f016bedfd5dfabf48f0726b0)
Signed-off-by: Christopher Faulet <cfaulet@haproxy.com>