tree b0befc2881d1b888c5358921b7d011ea70c646b0
parent 5d03639ba6fa9e7eee8af8fe489101de65d7f6f1
author Christopher Faulet <cfaulet@haproxy.com> 1593535952 +0200
committer Christopher Faulet <cfaulet@haproxy.com> 1593537407 +0200

BUG/MEDIUM: pattern: Add a trailing \0 to match strings only if possible

In pat_match_str() and pat_math_beg() functions, a trailing zero is
systematically added at the end of the string, even if the buffer is not large
enough to accommodate it. It is a possible buffer overflow. For instance, when
the alpn is matched against a list of strings, the sample fetch is filled with a
non-null terminated string returned by the SSL library. No trailing zero must be
added at the end of this string, because it is outside the buffer.

So, to fix the bug, a trailing zero is added only if the buffer is large enough
to accommodate it. Otherwise, the sample fetch is duplicated. smp_dup() function
adds a trailing zero to the duplicated string, truncating it if it is too long.

This patch should fix the issue #718. It must be backported to all supported
versions.