From: Christopher Faulet Date: Mon, 20 Jul 2026 15:50:20 +0000 (+0200) Subject: BUG/MEDIUM: sample: Adjust sample size capacity after pointer shift for ltrim() X-Git-Url: http://git.kaiwu.me/http/static/%22data:,/doc//%22%22?a=commitdiff_plain;h=7710a897eb2e65334494d92b54daaab96cee5a99;p=haproxy.git BUG/MEDIUM: sample: Adjust sample size capacity after pointer shift for ltrim() For the ltrim() converter, on success, the area pointer of the sample buffer is moved forward without updating the buffer size accordingly. If this converter is followed by another one relying on the buffer size to do some operations on the buffer area, this could lead to a buffer overflow. Thanks to Charles Vosburgh for reporting this and providing the fix. This patch must be backported to all supported versions. --- diff --git a/src/sample.c b/src/sample.c index ff4cffb54..b3dbd5ebc 100644 --- a/src/sample.c +++ b/src/sample.c @@ -4510,6 +4510,8 @@ static int sample_conv_ltrim(const struct arg *arg_p, struct sample *smp, void * l--; } + if (smp->data.u.str.size) + smp->data.u.str.size -= p - smp->data.u.str.area; smp->data.u.str.area = p; smp->data.u.str.data = l; return 1;