BUG/MINOR: sample: Fix a possible underflow on be2hex for large chunk size

For a chunk size exactly equal to bufsize/2, the "max_size" variable could
underflow if a separator is provided. Indeed, "max_size" is first set to
(trash->size - 2 * chunk_size), so to 0. And on the first iteration, the
separator length is removed, making it to underflow.

On 3.3 and lower it is especially an issue with samples larger than
bufsize/2 because data could be written ouside of the buffer. On 3.4 and
3.5, it is not an issue because we fail to retrieve a chunk.

This should be backported to all supported versions.

diff --git a/src/sample.c b/src/sample.c
index 84ce15c8076ebae58725cd50ab5956e3ee61a97e..1aaec60d98e630536d39751533cda40c84c99df9 100644 (file)
--- a/src/sample.c
+++ b/src/sample.c
@@ -2162,7 +2162,7 @@ static int sample_conv_be2hex(const struct arg *args, struct sample *smp, void *
        trash->data = 0;
        if (args[0].data.str.data == 0 && args[2].data.sint == 0)
                chunk_size = smp->data.u.str.data;
-       if (2 * (size_t)chunk_size > trash->size)
+       if (2 * (size_t)chunk_size + args[0].data.str.data > trash->size)
                return 0;
        max_size = trash->size - 2 * (size_t)chunk_size;