[Fix] fuzzy: fix stack overread in sqlite backend id

rspamd_snprintf's %xs treats its argument as a NUL terminated string and
calls strlen on it, but hash_out is a raw 64 byte digest with no
terminator. Building the backend id therefore read past the end of the
stack buffer, which ASAN reports as a stack-buffer-overflow on every
sqlite backend open.

Use %*xs with an explicit length, as re_cache.c and hs_helper.c already
do for the same kind of raw digest.

diff --git a/src/libserver/fuzzy_backend/fuzzy_backend_sqlite.c b/src/libserver/fuzzy_backend/fuzzy_backend_sqlite.c
index a953fc81ce0d3a01dce5f20b02974e5906e566eb..29435c38184f983b83b04098ebbaa783f735b54f 100644 (file)
--- a/src/libserver/fuzzy_backend/fuzzy_backend_sqlite.c
+++ b/src/libserver/fuzzy_backend/fuzzy_backend_sqlite.c
@@ -429,7 +429,12 @@ rspamd_fuzzy_backend_sqlite_open_db(const char *path, GError **err)
        rspamd_cryptobox_hash_init(&st, NULL, 0);
        rspamd_cryptobox_hash_update(&st, path, strlen(path));
        rspamd_cryptobox_hash_final(&st, hash_out);
-       rspamd_snprintf(bk->id, sizeof(bk->id), "%xs", hash_out);
+       /*
+        * hash_out is a raw digest, not a NUL terminated string: %xs would call
+        * strlen on it and read past the buffer. Pass the length explicitly.
+        */
+       rspamd_snprintf(bk->id, sizeof(bk->id), "%*xs",
+                                       (int) sizeof(hash_out), hash_out);
        memcpy(bk->pool->tag.uid, bk->id, sizeof(bk->pool->tag.uid));
 
        return bk;