]> git.ipfire.org Git - thirdparty/rspamd.git/commitdiff
[Fix] null-terminate the log tag when copying the header
authorAlex Maestas <alex.maestas@zendesk.com>
Wed, 3 Dec 2025 23:45:56 +0000 (15:45 -0800)
committerAlex Maestas <alex.maestas@zendesk.com>
Wed, 3 Dec 2025 23:45:56 +0000 (15:45 -0800)
This avoids leaking uninitialized heap memory.

src/libserver/protocol.c

index 0709d0ad2e9e93e1562eda67f1d6f6c05773ef0b..ccf26977d343a100874de4bd4cb1f434d7096825 100644 (file)
@@ -713,8 +713,9 @@ rspamd_protocol_handle_headers(struct rspamd_task *task,
                                msg_debug_protocol("read log-tag header, value: %T", hv_tok);
                                /* Ensure that a tag is valid */
                                if (rspamd_fast_utf8_validate(hv_tok->begin, hv_tok->len) == 0) {
-                                       memcpy(task->task_pool->tag.uid, hv_tok->begin,
-                                                  MIN(hv_tok->len, sizeof(task->task_pool->tag.uid)));
+                                       int len = MIN(hv_tok->len, sizeof(task->task_pool->tag.uid));
+                                       memcpy(task->task_pool->tag.uid, hv_tok->begin, len);
+                                       task->task_pool->tag.uid[len] = '\0';
                                }
                        }
                        break;