This bug exists in the basic implementation of strncat(dst,src,len) which will only copy EITHER to len or first \0 character, whichever comes first.
In squid this only occurs only if the string internal buffer is large enough to hold the existing plus the new strings.
The buffer re-allocation code used proper xmemcpy which does not have this limitation.
Have now set both append() branches to use the same copy mechanism.
/*
- * $Id: SqString.cc,v 1.3 2007/05/19 06:31:00 amosjeffries Exp $
+ * $Id: SqString.cc,v 1.4 2007/05/19 14:51:14 amosjeffries Exp $
*
* DEBUG: section 67 String
* AUTHOR: Duane Wessels
return;
if (len_ + len < size_) {
- strncat(buf_, str, len);
+ operator[](len_+len) = '\0';
+ xmemcpy(buf_+len_, str, len);
len_ += len;
} else {
unsigned int ssz = len_ + len;