From: Christopher Faulet <cfaulet@haproxy.com>
Date: Mon, 20 Jul 2026 15:07:39 +0000 (+0200)
Subject: BUG/MEDIUM: net-helper: Adjust sample size capacity after pointer shift
X-Git-Url: http://git.kaiwu.me/http/static/%22data:,/doc//%22?a=commitdiff_plain;h=65d462ba7c1de98bc1aaa2bef4880bcca8344e5f;p=haproxy.git

BUG/MEDIUM: net-helper: Adjust sample size capacity after pointer shift

eth.data, eth.src and ip.data converters are concerned. On success, the area
pointer of the sample buffer is moved forward without updating the buffer
size accordingly. If these converters are followed by another one relying on
the buffer size to do some operations on the buffer area, this could lead to
a buffer overflow.

Thanks to Charles Vosburgh <theminershive@gmail.com> for reporting this and
providing the fix.

This patch must be backported to 3.4.
---

diff --git a/src/net_helper.c b/src/net_helper.c
index 85990a289..4cfa457cb 100644
--- a/src/net_helper.c
+++ b/src/net_helper.c
@@ -25,6 +25,8 @@ static int sample_conv_eth_data(const struct arg *arg_p, struct sample *smp, voi
 
 	for (idx = 12; idx + 2 < smp->data.u.str.data; idx += 4) {
 		if (read_n16(smp->data.u.str.area + idx) != 0x8100) {
+			if (smp->data.u.str.size)
+				smp->data.u.str.size -= idx + 2;
 			smp->data.u.str.area += idx + 2;
 			smp->data.u.str.data -= idx + 2;
 			return 1;
@@ -90,6 +92,8 @@ static int sample_conv_eth_src(const struct arg *arg_p, struct sample *smp, void
 	if (smp->data.u.str.data < 12)
 		return 0;
 
+	if (smp->data.u.str.size)
+		smp->data.u.str.size -= 6;
 	smp->data.u.str.area += 6; // src is at address 6
 	smp->data.u.str.data  = 6; // output length is 6
 	return 1;
@@ -178,6 +182,8 @@ static int sample_conv_ip_data(const struct arg *arg_p, struct sample *smp, void
 		return 0;
 
 	/* advance buffer by <len> */
+	if (smp->data.u.str.size)
+		smp->data.u.str.size -= len;
 	smp->data.u.str.area += len;
 	smp->data.u.str.data -= len;
 	return 1;