mirrors/haproxy
1
0
Fork 0
mirror of https://git.haproxy.org/git/haproxy.git/ synced 2025-09-21 13:51:26 +02:00
Code Issues Projects Releases Wiki Activity

BUG/MINOR: sample: fix concat() converter's corruption with non-string variables

Browse Source 
Patrick Hemmer reported that calling concat() with an integer variable
causes a %00 to appear at the beginning of the output. Looking at the
code, it's not surprising. The function uses get_trash_chunk() to get
one of the trashes, but can call casting functions which will also use
their trash in turn and will cycle back to ours, causing the trash to
be overwritten before being assigned to a sample.

By allocating the trash from a pool using alloc_trash_chunk(), we can
avoid this. However we must free it so the trash's contents must be
moved to a permanent trash buffer before returning. This is what's
achieved using smp_dup().

This should be backported as far as 2.0.
This commit is contained in:
Willy Tarreau 2021-01-08 16:08:43 +01:00
parent 84c88a58c5
commit 591fc3a330
1 changed files with 3 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
src/sample.c
View File

@ -3000,7 +3000,7 @@ static int sample_conv_concat(const struct arg *arg_p, struct sample *smp, void
struct sample tmp; struct sample tmp;
int max; int max;
trash = get_trash_chunk(); trash = alloc_trash_chunk();
trash->data = smp->data.u.str.data; trash->data = smp->data.u.str.data;
if (trash->data > trash->size - 1) if (trash->data > trash->size - 1)
trash->data = trash->size - 1; trash->data = trash->size - 1;
@ -3052,6 +3052,8 @@ static int sample_conv_concat(const struct arg *arg_p, struct sample *smp, void
smp->data.u.str = *trash; smp->data.u.str = *trash;
smp->data.type = SMP_T_STR; smp->data.type = SMP_T_STR;
smp_dup(smp);
free_trash_chunk(trash);
return 1; return 1;
} }