CLEANUP: The function "regex_exec" needs the string length but in many case they expect null terminated char.

If haproxy is compiled with the USE_PCRE_JIT option, the length of the
string is used. If it is compiled without this option the function doesn't
use the length and expects a null terminated string.

The prototype of the function is ambiguous, and depends on the
compilation option. The developer can think that the length is always
used, and many bugs can be created.

This patch makes sure that the length is used. The regex_exec function
adds the final '\0' if it is needed.

include/common/regex.h

@@ -83,11 +83,20 @@ const char *check_replace_string(const char *str);
 const char *chain_regex(struct hdr_exp **head, const regex_t *preg,
 			int action, const char *replace, void *cond);
 
-static inline int regex_exec(const regex *preg, const char *subject, int length) {
+/* Note that <subject> MUST be at least <length+1> characters long and must
+ * be writable because the function will temporarily force a zero past the
+ * last character.
+ */
+static inline int regex_exec(const regex *preg, char *subject, int length) {
 #ifdef USE_PCRE_JIT
 	return pcre_exec(preg->reg, preg->extra, subject, length, 0, 0, NULL, 0);
 #else
-	return regexec(preg, subject, 0, NULL, 0);
+	int match;
+	char old_char = subject[length];
+	subject[length] = 0;
+	match = regexec(preg, subject, 0, NULL, 0);
+	subject[length] = old_char;
+	return match;
 #endif
 }
 

src/acl.c

@@ -163,19 +163,9 @@ static void *acl_lookup_str(struct sample *smp, struct acl_expr *expr)
  */
 int acl_match_reg(struct sample *smp, struct acl_pattern *pattern)
 {
-	char old_char;
-	int ret;
-
-	old_char = smp->data.str.str[smp->data.str.len];
-	smp->data.str.str[smp->data.str.len] = 0;
-
 	if (regex_exec(pattern->ptr.reg, smp->data.str.str, smp->data.str.len) == 0)
-		ret = ACL_PAT_PASS;
+		return ACL_PAT_PASS;
-	else
+	return ACL_PAT_FAIL;
-		ret = ACL_PAT_FAIL;
-
-	smp->data.str.str[smp->data.str.len] = old_char;
-	return ret;
 }
 
 /* Checks that the pattern matches the beginning of the tested string. */