From: Amos Jeffries <squid3@treenet.co.nz>
Date: Fri, 7 Mar 2014 11:18:03 +0000 (-0700)
Subject: Protect MemBlob::append() against raw-space writes
X-Git-Tag: SQUID_3_5_0_1~340
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=07bdd852d2eae2de46f5d6038d3db46d87503f00;p=thirdparty%2Fsquid.git

Protect MemBlob::append() against raw-space writes

There is no guarantee that the 'unused' area of MemBlob is actually
unused. For example if a read buffer was being filled into the
rawSpace() of a SBuf or MemBlob it will overlap with this empty area
until a read call updates the related size state in MemBlob/SBuf.

For these cases we must use memmove() which guarantees no buffer
corruption will take place on memory overlaps.
---

diff --git a/src/MemBlob.cc b/src/MemBlob.cc
index 7662c11a4e..d3ee617bc6 100644
--- a/src/MemBlob.cc
+++ b/src/MemBlob.cc
@@ -139,8 +139,7 @@ MemBlob::append(const char *source, const size_type n)
     if (n > 0) { // appending zero bytes is allowed but only affects the stats
         Must(willFit(n));
         Must(source);
-        /// \note memcpy() is safe because we copy to an unused area
-        memcpy(mem + size, source, n);
+        memmove(mem + size, source, n);
         size += n;
     }
     ++Stats.append;