1berry/haproxy
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

BUG/MINOR: tools: only fill first empty arg when not out of range

Browse Source 
In commit 3f2c8af313 ("MINOR: tools: make parse_line() provide hints
about empty args") we've added the ability to record the position of
the first empty arg in parse_line(), but that check requires to
access the args[] array for the current arg, which is not valid in
case we stopped on too large an argument count. Let's just check the
arg's validity before doing so.

This was reported by OSS Fuzz:
  https://issues.oss-fuzz.com/issues/415850462

No backport is needed since this was in the latest dev branch.
This commit is contained in:
Willy Tarreau 2025-05-07 07:22:24 +02:00
parent fbceabbccf
commit 10e6d0bd57
1 changed files with 3 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
src/tools.c
View File

@ -6439,7 +6439,7 @@ uint32_t parse_line(char *in, char *out, size_t *outlen, char **args, int *nbarg
err |= PARSE_ERR_TOOMANY;
}
if (prev_in_arg && !in_arg) {
if (!empty_arg_ptr && args[arg] == out + arg_start)
if (!empty_arg_ptr && arg < argsmax && args[arg] == out + arg_start)
empty_arg_ptr = begin_new_arg;
EMIT_CHAR(0);
arg++;
@ -6481,7 +6481,7 @@ uint32_t parse_line(char *in, char *out, size_t *outlen, char **args, int *nbarg
}
if (prev_in_arg && !in_arg) {
if (!empty_arg_ptr && args[arg] == out + arg_start)
if (!empty_arg_ptr && arg < argsmax && args[arg] == out + arg_start)
empty_arg_ptr = begin_new_arg;
EMIT_CHAR(0);
arg++;
@ -6490,7 +6490,7 @@ uint32_t parse_line(char *in, char *out, size_t *outlen, char **args, int *nbarg
/* end of output string */
if (in_arg) {
if (!empty_arg_ptr && args[arg] == out + arg_start)
if (!empty_arg_ptr && arg < argsmax && args[arg] == out + arg_start)
empty_arg_ptr = begin_new_arg;
EMIT_CHAR(0);
arg++;