Skip to content

slice: fix stpcpy off-by-one for header value extraction #13181

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
traeak wants to merge 1 commit into
base: master
Choose a base branch
from
Open

slice: fix stpcpy off-by-one for header value extraction #13181

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
26 changes: 14 additions & 12 deletions plugins/slice/HttpHeader.cc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -168,33 +168,35 @@ HttpHeader::removeKey(char const *const keystr, int const keylen)
bool
HttpHeader::valueForKey(char const *const keystr, int const keylen, char *const valstr, int *const vallen, int const index) const
{
if (!isValid()) {
if (nullptr == valstr || nullptr == vallen) {
return false;
}
if (!isValid() || index < -1) {
*vallen = 0;
return false;
}

bool status = false;

int const valcap = *vallen;
*vallen = 0;
valstr[0] = 0;

TSMLoc const locfield = TSMimeHdrFieldFind(m_buffer, m_lochdr, keystr, keylen);

if (nullptr != locfield) {
int getlen = 0;
char const *const getstr = TSMimeHdrFieldValueStringGet(m_buffer, m_lochdr, locfield, index, &getlen);

int const valcap = *vallen;
if (nullptr != getstr && 0 < getlen && getlen < (valcap - 1)) {
if (nullptr != getstr && 0 < getlen && getlen < valcap) {
char *const endp = stpncpy(valstr, getstr, getlen);

*vallen = endp - valstr;
status = (*vallen < valcap);

if (status) {
*endp = '\0';
int const len = endp - valstr;
if (len < valcap) {
*endp = '\0';
*vallen = len;
status = true;
}
}
TSHandleMLocRelease(m_buffer, m_lochdr, locfield);
} else {
*vallen = 0;
}

return status;
Expand Down
4 changes: 3 additions & 1 deletion plugins/slice/HttpHeader.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -114,7 +114,9 @@ struct HttpHeader {
// returns false if header invalid or something went wrong with removal.
bool removeKey(char const *const key, int const keylen);

// retrieves header value as a char*
// retrieves header value as a null terminated char* in valstr.
// caller must ensure the valstr buffer has sufficient capacity.
// null termination only guaranteed on success.
bool valueForKey(char const *const keystr, int const keylen,
char *const valstr, // <-- return string value
int *const vallen, // <-- pass in capacity, returns len of string
Expand Down