From: Willy Tarreau <w@1wt.eu>
Date: Sat, 15 Feb 2020 13:54:28 +0000 (+0100)
Subject: BUG/MINOR: arg: report an error if an argument is larger than bufsize
X-Git-Tag: v2.2-dev3~65
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=807aef8a14;p=thirdparty%2Fhaproxy.git

BUG/MINOR: arg: report an error if an argument is larger than bufsize

Commit ef21facd99 ("MEDIUM: arg: make make_arg_list() support quotes
in arguments") removed the chunk_strncpy() to fill the trash buffer
as the input is being parsed, and accidently dropped the jump to the
error path in case the argument is too large, which is now fixed.

No backport is needed, this is for 2.2. This addresses issue #502.
---

diff --git a/src/arg.c b/src/arg.c
index 3843a9b251..dffbb2efe9 100644
--- a/src/arg.c
+++ b/src/arg.c
@@ -213,6 +213,10 @@ int make_arg_list(const char *in, int len, uint64_t mask, struct arg **argp,
 			}
 			trash.data = out - trash.area;
 		}
+
+		if (len && *in)
+			goto buffer_err;
+
 		trash.area[trash.data] = 0;
 
 		arg->type = (mask >> (pos * ARGT_BITS)) & ARGT_MASK;