tree 2c03f5986d89eafd51b32b7451d45620dc1bb947
parent cd6599150f3a12459e9fcd1cd45be207f12bb4be
author Thierry FOURNIER <tfournier@exceliance.fr> 1386761937 +0100
committer Willy Tarreau <w@1wt.eu> 1386795780 +0100
encoding latin1

BUG/MEDIUM: sample: conversion from str to ipv6 may read data past end

Applying inet_pton() to input contents is not reliable because the
function requires a zero-terminated string. While inet_pton() will
stop when contents do not match an IPv6 address anymore, it could
theorically read past the end of a buffer if the data to be converted
was at the end of a buffer (this cannot happen right now thanks to
the reserve at the end of the buffer). At least the conversion does
not work.

Fix this by using buf2ip6() instead, which copies the string into a
padded aread.

This bug came with recent commit b805f71 (MEDIUM: sample: let the
cast functions set their output type), no backport is needed.