compression buffer was not reused correctly

when the compression buffer was reused for multiple statistics
requests, responses could grow beyond the correct size. this was
because the buffer was not cleared before reuse; compressed data
was still written to the beginning of the buffer, but then the size
of used region was increased by the amount written, rather than set
to the amount written. this caused responses to grow larger and
larger, potentially reading past the end of the allocated buffer.

(cherry picked from commit 47e9fa981e56a7a232f3219fe8a40525c79d748b)

diff --git a/lib/isc/httpd.c b/lib/isc/httpd.c
index a701fb2a8423d03d504ebf7362f11553ea25d990..14c9fbfe815f39671200292a1929bbaa057c96e0 100644 (file)
--- a/lib/isc/httpd.c
+++ b/lib/isc/httpd.c
@@ -202,6 +202,8 @@ free_buffer(isc_mem_t *mctx, isc_buffer_t *buffer) {
        if (r.base != NULL) {
                isc_mem_put(mctx, r.base, r.length);
        }
+
+       isc_buffer_initnull(buffer);
 }
 
 isc_result_t
@@ -861,6 +863,7 @@ httpd_compress(isc_httpd_t *httpd) {
 
        inputlen = isc_buffer_usedlength(&httpd->bodybuffer);
        alloc_compspace(httpd, inputlen);
+       isc_buffer_clear(&httpd->compbuffer);
        isc_buffer_region(&httpd->compbuffer, &r);
 
        /*