From: Lennart Poettering <lennart@poettering.net>
Date: Wed, 5 Nov 2025 15:48:24 +0000 (+0100)
Subject: pull-job: always implicitly NUL terminate downloaded payload stored in memory
X-Git-Tag: v259-rc1~127^2~8
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=bf51a545a4fd60ce27da74bed98c139157fb1984;p=thirdparty%2Fsystemd.git

pull-job: always implicitly NUL terminate downloaded payload stored in memory

Just as a safety measure, let's always NUL terminate what we are
downloading, maybe future code will parse it as string, and is sloppy by
accident.

(We have similar logic in read_full_file(), and I think it's a really
good rule, to always implicitly NUL terminate blobs we acquire that
might very well be used as text later on)
---

diff --git a/src/import/pull-job.c b/src/import/pull-job.c
index b457c39ed18..6c7b328a0c4 100644
--- a/src/import/pull-job.c
+++ b/src/import/pull-job.c
@@ -343,10 +343,10 @@ static int pull_job_write_uncompressed(const void *p, size_t sz, void *userdata)
         }
 
         if (j->disk_fd < 0 || j->force_memory) {
-                if (!GREEDY_REALLOC(j->payload, j->payload_size + sz))
+                if (!GREEDY_REALLOC(j->payload, j->payload_size + sz + 1))
                         return log_oom();
 
-                memcpy(j->payload + j->payload_size, p, sz);
+                *((char*) mempcpy(j->payload + j->payload_size, p, sz)) = 0;
                 j->payload_size += sz;
         }