From: Christopher Faulet <cfaulet@haproxy.com>
Date: Mon, 15 Feb 2021 15:24:10 +0000 (+0100)
Subject: MINOR: server: Be more strict when reading the version of a server-state file
X-Git-Tag: v2.4-dev10~32
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=8a14b73ecf992e535301972e0b7d9e7f14d1eb4c;p=thirdparty%2Fhaproxy.git

MINOR: server: Be more strict when reading the version of a server-state file

Now, we read a full line and expects to found an integer only on it. And if
the line is empty or truncated, an error is returned. If the version is not
valid, an error is also returned. This way, the first line is no longer
partially read.
---

diff --git a/src/server.c b/src/server.c
index bcfdbb277d..b9fa115b9d 100644
--- a/src/server.c
+++ b/src/server.c
@@ -3049,20 +3049,26 @@ static void srv_update_state(struct server *srv, int version, char **params)
  * Note that this should be the first read on <f>
  */
 static int srv_state_get_version(FILE *f) {
-	char buf[2];
-	int ret;
+	char mybuf[SRV_STATE_LINE_MAXLEN];
+	char *endptr;
+	long int vsn;
 
 	/* first character of first line of the file must contain the version of the export */
-	if (fgets(buf, 2, f) == NULL) {
+	if (fgets(mybuf, SRV_STATE_LINE_MAXLEN, f) == NULL)
+		return 0;
+
+	vsn = strtol(mybuf, &endptr, 10);
+	if (endptr == mybuf || *endptr != '\n') {
+		/* Empty or truncated line */
 		return 0;
 	}
 
-	ret = atoi(buf);
-	if ((ret < SRV_STATE_FILE_VERSION_MIN) ||
-	    (ret > SRV_STATE_FILE_VERSION_MAX))
+	if (vsn < SRV_STATE_FILE_VERSION_MIN || vsn > SRV_STATE_FILE_VERSION_MAX) {
+		/* Wrong version number */
 		return 0;
+	}
 
-	return ret;
+	return vsn;
 }