tree 3560f3fd7f081d5bad2893a153cfc77a3485220d
parent 8a6767d266e0b885d1752a99cbe6b1e11c4e4256
author Willy Tarreau <w@1wt.eu> 1664778475 +0200
committer Willy Tarreau <w@1wt.eu> 1664781866 +0200
encoding latin1

BUG/MEDIUM: config: count line arguments without dereferencing the output

Previous commit 8a6767d26 ("BUG/MINOR: config: don't count trailing spaces
as empty arg (v2)") was still not enough. As reported by ClusterFuzz in
issue 52049 (https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=52049),
there remains a case where for the sake of reporting the correct argument
count, the function may produce virtual args that span beyond the end of
the output buffer if that one is too short. That's what's happening with
a config file of one empty line followed by a large number of args.

This means that what args[] points to cannot be relied on and that a
different approach is needed. Since no output is produced for spaces and
comments, we know that args[arg] continues to point to out+outpos as long
as only comments or spaces are found, which is what we're interested in.

As such it's safe to check the last arg's pointer against the one before
the trailing zero was emitted, in order to decide to count one final arg.

No backport is needed, unless the commit above is backported.