From 980fd3fcc674945eb3a43b146c3e803b98c0cd12 Mon Sep 17 00:00:00 2001 From: Christopher Faulet Date: Mon, 20 Jul 2026 17:48:47 +0200 Subject: [PATCH] BUG/MEDIUM: sample: Adjust sample size capacity after pointer shift for bytes() For the bytes() converter, on success, the area pointer of the sample buffer is moved forward without updating the buffer size accordingly. If this converter is followed by another one relying on the buffer size to do some operations on the buffer area, this could lead to a buffer overflow. Thanks to Charles Vosburgh for reporting this and providing the fix. This patch must be backported to 3.0. --- src/sample.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/src/sample.c b/src/sample.c index c2d0472d7..ff4cffb54 100644 --- a/src/sample.c +++ b/src/sample.c @@ -2988,6 +2988,8 @@ static int sample_conv_bytes(const struct arg *arg_p, struct sample *smp, void * } // update the output using the start_idx and length + if (smp->data.u.str.size) + smp->data.u.str.size -= start_idx; smp->data.u.str.area += start_idx; smp->data.u.str.data = length; -- 2.47.3