From 821076f6aeb58950ca60fcc0f676f0ce5a63a544 Mon Sep 17 00:00:00 2001 From: Willy Tarreau Date: Tue, 1 Sep 2026 18:29:58 +0200 Subject: [PATCH] BUG/MINOR: tools: support the documented NULL in cbor_encode_bytes_prefix_bin() Both cbor_encode_bytes_prefix_bin() and cbor_encode_text_bin() document that "if is NULL, then only the (with length) will be emitted", and the hex variants do implement it, their copy loop being guarded with "while (bytes && it < len)". The bin one does not: it calls memcpy() unconditionally, so passing NULL dereferences it and crashes, and it advances by for bytes it never wrote. No caller passed NULL so far, which is why this remained unnoticed, but better fix it before it gets used, as it's trivial. No backport needed. --- src/tools.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/src/tools.c b/src/tools.c index 24a40a4b1..186e3a144 100644 --- a/src/tools.c +++ b/src/tools.c @@ -2408,10 +2408,12 @@ static inline char *_cbor_encode_bytes_prefix_bin(char *start, char *stop, return NULL; /* write actual bytes if provided */ - if (start + len >= stop) - return NULL; - memcpy(start, bytes, len); - start += len; + if (bytes) { + if (start + len >= stop) + return NULL; + memcpy(start, bytes, len); + start += len; + } return start; } -- 2.47.3