From: Maxime Henrion Date: Thu, 9 Jul 2026 16:08:33 +0000 (-0400) Subject: MINOR: shctx: clamp shctx_row_data_get() reads against the offset X-Git-Url: http://git.kaiwu.me/%7Bsubstring-before(@doc,%20'.xml')%7D.html?a=commitdiff_plain;h=0386ec2544d5ce4062158c0d971f8e753080b974;p=haproxy.git MINOR: shctx: clamp shctx_row_data_get() reads against the offset The length clamp capped the request to the whole row length but ignored , so a read starting past the beginning of the row could run beyond the stored data and copy stale bytes from the reserved tail of its blocks. No current caller reads past first->len so this was never triggered, but the helper is public and its contract does not forbid it. Clamp against (first->len - offset) instead, returning early when the offset is already at or past the stored data. This may be backported along with the shctx_row_data_get() offset fix. --- diff --git a/src/shctx.c b/src/shctx.c index cb580b14e..2d443133e 100644 --- a/src/shctx.c +++ b/src/shctx.c @@ -229,9 +229,11 @@ int shctx_row_data_get(struct shared_context *shctx, struct shared_block *first, int count, size, start = -1; struct shared_block *block; - /* can't copy more */ - if (len > first->len) - len = first->len; + /* can't copy more than what is stored past */ + if (offset >= first->len) + return len; + if (len > first->len - offset) + len = first->len - offset; /* Walk the blocks, skipping those that precede the one holding . */ for (block = first, count = 0; count < first->block_count && len > 0;