From: Alex Maestas <alex.maestas@zendesk.com>
Date: Wed, 3 Dec 2025 23:45:56 +0000 (-0800)
Subject: [Fix] null-terminate the log tag when copying the header
X-Git-Tag: 3.14.2~34^2~1
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=eafc9487b579e959c188329e78eefa9f79a86e87;p=thirdparty%2Frspamd.git

[Fix] null-terminate the log tag when copying the header

This avoids leaking uninitialized heap memory.
---

diff --git a/src/libserver/protocol.c b/src/libserver/protocol.c
index 0709d0ad2e..ccf26977d3 100644
--- a/src/libserver/protocol.c
+++ b/src/libserver/protocol.c
@@ -713,8 +713,9 @@ rspamd_protocol_handle_headers(struct rspamd_task *task,
 				msg_debug_protocol("read log-tag header, value: %T", hv_tok);
 				/* Ensure that a tag is valid */
 				if (rspamd_fast_utf8_validate(hv_tok->begin, hv_tok->len) == 0) {
-					memcpy(task->task_pool->tag.uid, hv_tok->begin,
-						   MIN(hv_tok->len, sizeof(task->task_pool->tag.uid)));
+					int len = MIN(hv_tok->len, sizeof(task->task_pool->tag.uid));
+					memcpy(task->task_pool->tag.uid, hv_tok->begin, len);
+					task->task_pool->tag.uid[len] = '\0';
 				}
 			}
 			break;