BUG/MINOR: spoe: reject a \0 byte in a string sent by the agent

A string sample cannot contain a \0 byte, but spoe_decode_data() stored
a SPOP string value as is, so an agent could set a variable holding a
\0. Such a value was then matched by "-m str" on its prefix.

SPOP has a distinct binary type for such values, so a string holding a
\0 byte is malformed: fail the decoding, which drops the action like
any other invalid one.

This must be backported to all stable branches.

diff --git a/include/haproxy/spoe.h b/include/haproxy/spoe.h
index eeae37181527b389842cfa776c1a19fe07960c90..70bafe6d711ab082d033c62803dee9d4444f22e2 100644 (file)
--- a/include/haproxy/spoe.h
+++ b/include/haproxy/spoe.h
@@ -277,6 +277,9 @@ static inline int spoe_decode_data(char **buf, char *end, struct sample *smp)
                        /* All the buffer must be decoded */
                        if (spoe_decode_buffer(&p, end, &str, &sz) == -1)
                                return -1;
+                       /* a string sample cannot contain a NUL byte */
+                       if (type == SPOP_DATA_T_STR && memchr(str, 0, sz))
+                               return -1;
                        smp->data.u.str.area = str;
                        smp->data.u.str.data = sz;
                        smp->data.type = (type == SPOP_DATA_T_STR) ? SMP_T_STR : SMP_T_BIN;