From: Christopher Faulet <cfaulet@haproxy.com>
Date: Mon, 20 Jul 2026 15:48:47 +0000 (+0200)
Subject: BUG/MEDIUM: sample: Adjust sample size capacity after pointer shift for bytes()
X-Git-Url: http://git.kaiwu.me/http/doc/%22data:,/$%7BGITURL%7D$%7Bcid%7D?a=commitdiff_plain;h=980fd3fcc674945eb3a43b146c3e803b98c0cd12;p=haproxy.git

BUG/MEDIUM: sample: Adjust sample size capacity after pointer shift for bytes()

For the bytes() converter, on success, the area pointer of the sample buffer
is moved forward without updating the buffer size accordingly. If this
converter is followed by another one relying on the buffer size to do some
operations on the buffer area, this could lead to a buffer overflow.

Thanks to Charles Vosburgh <theminershive@gmail.com> for reporting this and
providing the fix.

This patch must be backported to 3.0.
---

diff --git a/src/sample.c b/src/sample.c
index c2d0472d7..ff4cffb54 100644
--- a/src/sample.c
+++ b/src/sample.c
@@ -2988,6 +2988,8 @@ static int sample_conv_bytes(const struct arg *arg_p, struct sample *smp, void *
 	}
 
 	// update the output using the start_idx and length
+	if (smp->data.u.str.size)
+		smp->data.u.str.size -= start_idx;
 	smp->data.u.str.area += start_idx;
 	smp->data.u.str.data = length;