BUG/MEDIUM: sample: Adjust sample size capacity after pointer shift for bytes()

For the bytes() converter, on success, the area pointer of the sample buffer
is moved forward without updating the buffer size accordingly. If this
converter is followed by another one relying on the buffer size to do some
operations on the buffer area, this could lead to a buffer overflow.

Thanks to Charles Vosburgh <theminershive@gmail.com> for reporting this and
providing the fix.

This patch must be backported to 3.0.

diff --git a/src/sample.c b/src/sample.c
index c2d0472d7754f057136b43fb02f31a43e1a72233..ff4cffb54960879be88fe246fe457778b54a76ee 100644 (file)
--- a/src/sample.c
+++ b/src/sample.c
@@ -2988,6 +2988,8 @@ static int sample_conv_bytes(const struct arg *arg_p, struct sample *smp, void *
        }
 
        // update the output using the start_idx and length
+       if (smp->data.u.str.size)
+               smp->data.u.str.size -= start_idx;
        smp->data.u.str.area += start_idx;
        smp->data.u.str.data = length;