]> git.ipfire.org Git - thirdparty/haproxy.git/commit
BUG/MINOR: spoe: check snprintf() return value in spoe_set_var/spoe_unset_var master
authorWilliam Lallemand <wlallemand@haproxy.com>
Fri, 14 Aug 2026 09:39:12 +0000 (09:39 +0000)
committerWilliam Lallemand <wlallemand@haproxy.com>
Fri, 14 Aug 2026 09:44:00 +0000 (09:44 +0000)
commit23a2811b672b06103b1185ee3a49d6c157478097
tree7a2ce2041abb778caed5c6b9db91fccefa2850e3
parent21ba33f12d936764f868b6561f7d5e677b241139
BUG/MINOR: spoe: check snprintf() return value in spoe_set_var/spoe_unset_var

snprintf() returns the length it would have written, not what actually
fit in varname[64]. A SET-VAR/UNSET-VAR name long enough to overflow
that buffer left len oversized, causing an out-of-bounds stack read in
the variable-name validation and hashing in vars_fill_desc().

Reject the action instead of proceeding on truncation: an oversized
name would otherwise be silently used under a different, truncated
name, which could let two distinct long names collide on the same
63-byte prefix.

This should be backported to all stable branches.

Reported-by: Aisle Research
Reported-by: Oyvind Albrigtsen <oalbrigt@redhat.com>
src/flt_spoe.c