From: Willy Tarreau <w@1wt.eu>
Date: Wed, 22 Aug 2018 02:55:43 +0000 (+0200)
Subject: BUG/MEDIUM: map: don't store exp_replace() result in the trash's length
X-Git-Tag: v1.9-dev2~126
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=2842e05c7c9d9fb7e03f8900f778dc4fae4deb78;p=thirdparty%2Fhaproxy.git

BUG/MEDIUM: map: don't store exp_replace() result in the trash's length

By convenience or laziness we used to store exp_replace()'s return code
into str->data. The result checks applied there compare str->data to -1
while it's now unsigned since commit 843b7cb ("MEDIUM: chunks: make the
chunk struct's fields match the buffer struct"). Let's clean this up
and test the result itself without storing it first.

No backport is needed.
---

diff --git a/src/map.c b/src/map.c
index d2df22e212..d94b0f2605 100644
--- a/src/map.c
+++ b/src/map.c
@@ -186,6 +186,7 @@ static int sample_conv_map(const struct arg *arg_p, struct sample *smp, void *pr
 			/* In the regm case, merge the sample with the input. */
 			if ((long)private == PAT_MATCH_REGM) {
 				struct buffer *tmptrash;
+				int len;
 
 				/* Copy the content of the sample because it could
 				   be scratched by incoming get_trash_chunk */
@@ -201,12 +202,14 @@ static int sample_conv_map(const struct arg *arg_p, struct sample *smp, void *pr
 				tmptrash->area[tmptrash->data] = 0;
 
 				str = get_trash_chunk();
-				str->data = exp_replace(str->area, str->size,
-				                        tmptrash->area,
-				                        pat->data->u.str.area,
-				                        (regmatch_t *)smp->ctx.a[0]);
-				if (str->data == -1)
+				len = exp_replace(str->area, str->size,
+				                  tmptrash->area,
+				                  pat->data->u.str.area,
+				                  (regmatch_t *)smp->ctx.a[0]);
+				if (len == -1)
 					return 0;
+
+				str->data = len;
 				smp->data.u.str = *str;
 				return 1;
 			}