From: James Jones <jejones3141@gmail.com>
Date: Wed, 1 Jun 2022 14:43:30 +0000 (-0500)
Subject: Check fr_sbuff_in_bstrncpy() return in xlat_func_rpad() (CID #15039490) (#4515)
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=3317d67e2cc3b1f55fd8384ddddb8d80fa90db52;p=thirdparty%2Ffreeradius-server.git

Check fr_sbuff_in_bstrncpy() return in xlat_func_rpad() (CID #15039490) (#4515)
---

diff --git a/src/lib/unlang/xlat_builtin.c b/src/lib/unlang/xlat_builtin.c
index 281b0ae9c04..a8ef02f6b71 100644
--- a/src/lib/unlang/xlat_builtin.c
+++ b/src/lib/unlang/xlat_builtin.c
@@ -1777,6 +1777,7 @@ static xlat_action_t xlat_func_rpad(UNUSED TALLOC_CTX *ctx, fr_dcursor_t *out,
 		if (len >= pad_len) continue;
 
 		if (fr_value_box_bstr_realloc(in, &buff, in, pad_len) < 0) {
+		fail:
 			RPEDEBUG("Failed reallocing input data");
 			return XLAT_ACTION_FAIL;
 		}
@@ -1793,7 +1794,9 @@ static xlat_action_t xlat_func_rpad(UNUSED TALLOC_CTX *ctx, fr_dcursor_t *out,
 		 *	Copy fill as a repeating pattern
 		 */
 		while ((remaining = fr_sbuff_remaining(&sbuff))) {
-			fr_sbuff_in_bstrncpy(&sbuff, fill_str, remaining >= fill_len ? fill_len : remaining);
+			if (fr_sbuff_in_bstrncpy(&sbuff, fill_str, remaining >= fill_len ? fill_len : remaining) < 0) {
+				goto fail;
+			}
 		}
 	}