From: Willy Tarreau <w@1wt.eu>
Date: Tue, 1 Sep 2026 16:29:58 +0000 (+0200)
Subject: BUG/MINOR: tools: support the documented NULL in cbor_encode_bytes_prefix_bin()
X-Git-Tag: v3.5-dev6~10
X-Git-Url: https://git.kaiwu.me/?a=commitdiff_plain;h=821076f6aeb58950ca60fcc0f676f0ce5a63a544;p=haproxy.git

BUG/MINOR: tools: support the documented NULL in cbor_encode_bytes_prefix_bin()

Both cbor_encode_bytes_prefix_bin() and cbor_encode_text_bin() document
that "if <bytes> is NULL, then only the <prefix> (with length) will be
emitted", and the hex variants do implement it, their copy loop being
guarded with "while (bytes && it < len)". The bin one does not: it calls
memcpy() unconditionally, so passing NULL dereferences it and crashes,
and it advances <start> by <len> for bytes it never wrote.

No caller passed NULL so far, which is why this remained unnoticed, but
better fix it before it gets used, as it's trivial.

No backport needed.
---

diff --git a/src/tools.c b/src/tools.c
index 24a40a4b1..186e3a144 100644
--- a/src/tools.c
+++ b/src/tools.c
@@ -2408,10 +2408,12 @@ static inline char *_cbor_encode_bytes_prefix_bin(char *start, char *stop,
 		return NULL;
 
 	/* write actual bytes if provided */
-	if (start + len >= stop)
-		return NULL;
-	memcpy(start, bytes, len);
-	start += len;
+	if (bytes) {
+		if (start + len >= stop)
+			return NULL;
+		memcpy(start, bytes, len);
+		start += len;
+	}
 
 	return start;
 }