From: Christopher Faulet <cfaulet@haproxy.com>
Date: Tue, 7 Jul 2026 12:13:49 +0000 (+0200)
Subject: BUG/MINOR: sample: Fix a possible underflow on be2hex for large chunk size
X-Git-Tag: v3.5-dev2~24
X-Git-Url: http://git.kaiwu.me/%22data:,/static/$%7BGITURL%7D/1?a=commitdiff_plain;h=ee5cfaf2667bec5930f2ca7aea60ededa1b94ed2;p=haproxy.git

BUG/MINOR: sample: Fix a possible underflow on be2hex for large chunk size

For a chunk size exactly equal to bufsize/2, the "max_size" variable could
underflow if a separator is provided. Indeed, "max_size" is first set to
(trash->size - 2 * chunk_size), so to 0. And on the first iteration, the
separator length is removed, making it to underflow.

On 3.3 and lower it is especially an issue with samples larger than
bufsize/2 because data could be written ouside of the buffer. On 3.4 and
3.5, it is not an issue because we fail to retrieve a chunk.

This should be backported to all supported versions.
---

diff --git a/src/sample.c b/src/sample.c
index 84ce15c80..1aaec60d9 100644
--- a/src/sample.c
+++ b/src/sample.c
@@ -2162,7 +2162,7 @@ static int sample_conv_be2hex(const struct arg *args, struct sample *smp, void *
 	trash->data = 0;
 	if (args[0].data.str.data == 0 && args[2].data.sint == 0)
 		chunk_size = smp->data.u.str.data;
-	if (2 * (size_t)chunk_size > trash->size)
+	if (2 * (size_t)chunk_size + args[0].data.str.data > trash->size)
 		return 0;
 	max_size = trash->size - 2 * (size_t)chunk_size;