From: Frederic Lecaille <flecaille@haproxy.com>
Date: Mon, 14 Sep 2026 13:58:02 +0000 (+0200)
Subject: BUG/MINOR: spoe: reject a \0 byte in a string sent by the agent
X-Git-Url: https://git.kaiwu.me/?a=commitdiff_plain;h=c783d9461d17143cee0909ac267c0074abef3606;p=haproxy.git

BUG/MINOR: spoe: reject a \0 byte in a string sent by the agent

A string sample cannot contain a \0 byte, but spoe_decode_data() stored
a SPOP string value as is, so an agent could set a variable holding a
\0. Such a value was then matched by "-m str" on its prefix.

SPOP has a distinct binary type for such values, so a string holding a
\0 byte is malformed: fail the decoding, which drops the action like
any other invalid one.

This must be backported to all stable branches.
---

diff --git a/include/haproxy/spoe.h b/include/haproxy/spoe.h
index eeae37181..70bafe6d7 100644
--- a/include/haproxy/spoe.h
+++ b/include/haproxy/spoe.h
@@ -277,6 +277,9 @@ static inline int spoe_decode_data(char **buf, char *end, struct sample *smp)
 			/* All the buffer must be decoded */
 			if (spoe_decode_buffer(&p, end, &str, &sz) == -1)
 				return -1;
+			/* a string sample cannot contain a NUL byte */
+			if (type == SPOP_DATA_T_STR && memchr(str, 0, sz))
+				return -1;
 			smp->data.u.str.area = str;
 			smp->data.u.str.data = sz;
 			smp->data.type = (type == SPOP_DATA_T_STR) ? SMP_T_STR : SMP_T_BIN;