mirrors/haproxy
1
0
Fork 0
mirror of https://git.haproxy.org/git/haproxy.git/ synced 2026-03-18 13:31:11 +01:00
Code Issues Projects Releases Wiki Activity

BUG/MINOR: deviceatlas: fix off-by-one in da_haproxy_conv()

Browse Source 
The user-agent string copy had an off-by-one error: the buffer size
limit did not account for the null terminator, and the memcpy length
used i-1 which truncated the last character of the user-agent string.

This should be backported to lower branches.
This commit is contained in:
David Carlier 2026-02-14 13:23:58 +00:00 committed by Willy Tarreau
parent d8f219b380
commit 7098b4f93a
1 changed files with 5 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
addons/deviceatlas/da.c
View File

@ -393,8 +393,7 @@ static int da_haproxy_conv(const struct arg *args, struct sample *smp, void *pri
{
da_deviceinfo_t devinfo;
da_status_t status;
const char *useragent;
char useragentbuf[1024] = { 0 };
char useragentbuf[1024];
int i;
if (global_deviceatlas.daset == 0 || smp->data.u.str.data == 0) {
@ -403,14 +402,12 @@ static int da_haproxy_conv(const struct arg *args, struct sample *smp, void *pri
da_haproxy_checkinst();
i = smp->data.u.str.data > sizeof(useragentbuf) ? sizeof(useragentbuf) : smp->data.u.str.data;
memcpy(useragentbuf, smp->data.u.str.area, i - 1);
useragentbuf[i - 1] = 0;
useragent = (const char *)useragentbuf;
i = smp->data.u.str.data > sizeof(useragentbuf) - 1 ? sizeof(useragentbuf) - 1 : smp->data.u.str.data;
memcpy(useragentbuf, smp->data.u.str.area, i);
useragentbuf[i] = 0;
status = da_search(&global_deviceatlas.atlas, &devinfo,
global_deviceatlas.useragentid, useragent, 0);
global_deviceatlas.useragentid, useragentbuf, 0);
return status != DA_OK ? 0 : da_haproxy(args, smp, &devinfo);
}