BUG/MEDIUM: ssl: fix off-by-one in NPN list allocation
After seeing previous ALPN fix, I suspected that NPN code was wrong
as well, and indeed it was since ALPN was copied from it. This fix
must be backported into 1.6 and 1.5.
(cherry picked from commit 3724da126115d6ad0ccecbbcea05c54b4accaac4)
(cherry picked from commit 28cc8f12890a05934a99d7620b482896486b8a21)
diff --git a/src/ssl_sock.c b/src/ssl_sock.c
index a7da4e5..ead4c7b 100644
--- a/src/ssl_sock.c
+++ b/src/ssl_sock.c
@@ -3988,9 +3988,12 @@
free(conf->npn_str);
- /* the NPN string is built as a suite of (<len> <name>)* */
+ /* the NPN string is built as a suite of (<len> <name>)*,
+ * so we reuse each comma to store the next <len> and need
+ * one more for the end of the string.
+ */
conf->npn_len = strlen(args[cur_arg + 1]) + 1;
- conf->npn_str = calloc(1, conf->npn_len);
+ conf->npn_str = calloc(1, conf->npn_len + 1);
memcpy(conf->npn_str + 1, args[cur_arg + 1], conf->npn_len);
/* replace commas with the name length */