From: William Lallemand <wlallemand@haproxy.com>
Date: Mon, 25 Nov 2019 08:58:37 +0000 (+0100)
Subject: BUG/MINOR: cli: fix out of bounds in -S parser
X-Git-Tag: v2.1.0~13
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=2e945c8ee7d5cb358d98c4333a66b0d6631cefa6;p=thirdparty%2Fhaproxy.git

BUG/MINOR: cli: fix out of bounds in -S parser

Out of bounds when the number or arguments is greater than
MAX_LINE_ARGS.

Fix issue #377.

Must be backported in 2.0 and 1.9.
---

diff --git a/src/cli.c b/src/cli.c
index db695d5fd3..77db8be883 100644
--- a/src/cli.c
+++ b/src/cli.c
@@ -2526,7 +2526,7 @@ int mworker_cli_proxy_new_listener(char *line)
 	int arg;
 	int cur_arg;
 
-	arg = 0;
+	arg = 1;
 	args[0] = line;
 
 	/* args is a bind configuration with spaces replaced by commas */
@@ -2536,12 +2536,12 @@ int mworker_cli_proxy_new_listener(char *line)
 			*line++ = '\0';
 			while (*line == ',')
 				line++;
-			args[++arg] = line;
+			args[arg++] = line;
 		}
 		line++;
 	}
 
-	args[++arg] = "\0";
+	args[arg] = "\0";
 
 	bind_conf = bind_conf_alloc(mworker_proxy, "master-socket", 0, "", xprt_get(XPRT_RAW));
 	if (!bind_conf)