RepoMirrors
/
haproxy
mirror of http://git.haproxy.org/git/haproxy.git/
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

BUG/MINOR: chunk: Fix tests on the chunk size in functions copying data 

When raw data are copied or appended in a chunk, the result must not exceed the
chunk size but it can reach it. Unlike functions to copy or append a string,
there is no terminating null byte.

This patch must be backported as far as 1.8. Note in 1.8, the functions
chunk_cpy() and chunk_cat() don't exist.
This commit is contained in:
Christopher Faulet 2019-10-14 11:29:48 +02:00
parent e0f8dc576f
commit 48fa033f28
1 changed files with 4 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
include/common/chunk.h
View File

@ -98,7 +98,7 @@ static inline void chunk_initstr(struct buffer *chk, const char *str)
/* copies chunk <src> into <chk>. Returns 0 in case of failure. */
static inline int chunk_cpy(struct buffer *chk, const struct buffer *src)
{
if (unlikely(src->data >= chk->size))
if (unlikely(src->data > chk->size))
return 0;
chk->data = src->data;
@ -109,7 +109,7 @@ static inline int chunk_cpy(struct buffer *chk, const struct buffer *src)
/* appends chunk <src> after <chk>. Returns 0 in case of failure. */
static inline int chunk_cat(struct buffer *chk, const struct buffer *src)
{
if (unlikely(chk->data + src->data >= chk->size))
if (unlikely(chk->data + src->data > chk->size))
return 0;
memcpy(chk->area + chk->data, src->area, src->data);
@ -123,7 +123,7 @@ static inline int chunk_cat(struct buffer *chk, const struct buffer *src)
static inline int chunk_memcpy(struct buffer *chk, const char *src,
size_t len)
{
if (unlikely(len >= chk->size))
if (unlikely(len > chk->size))
return 0;
chk->data = len;
@ -138,7 +138,7 @@ static inline int chunk_memcpy(struct buffer *chk, const char *src,
static inline int chunk_memcat(struct buffer *chk, const char *src,
size_t len)
{
if (unlikely(chk->data + len >= chk->size))
if (unlikely(chk->data + len > chk->size))
return 0;
memcpy(chk->area + chk->data, src, len);