BUG/MEDIUM: sample: Adjust sample size capacity after pointer shift for ltrim()

For the ltrim() converter, on success, the area pointer of the sample buffer
is moved forward without updating the buffer size accordingly. If this
converter is followed by another one relying on the buffer size to do some
operations on the buffer area, this could lead to a buffer overflow.

Thanks to Charles Vosburgh <theminershive@gmail.com> for reporting this and
providing the fix.

This patch must be backported to all supported versions.

diff --git a/src/sample.c b/src/sample.c
index ff4cffb54960879be88fe246fe457778b54a76ee..b3dbd5ebcea606dab62f9f939035afc612a93e9e 100644 (file)
--- a/src/sample.c
+++ b/src/sample.c
@@ -4510,6 +4510,8 @@ static int sample_conv_ltrim(const struct arg *arg_p, struct sample *smp, void *
                l--;
        }
 
+       if (smp->data.u.str.size)
+               smp->data.u.str.size -= p - smp->data.u.str.area;
        smp->data.u.str.area = p;
        smp->data.u.str.data = l;
        return 1;