memcpy to or from NULL is undefined behavior, even for copies of
length 0. See this godbolt link for an example of how this can cause
problems: https://gcc.godbolt.org/z/zfvnMMsds

This patch avoids calling memcpy for 0-length buckets, so that buckets
with NULL data and 0 length don't cause UB when flattened.

Addresses this bugzilla report from httpd:
https://bz.apache.org/bugzilla/show_bug.cgi?id=68278

--- apr_brigade-old.c   2023-12-14 21:12:48.616409321 +0000
+++ apr_brigade.c       2023-12-14 21:10:20.477289754 +0000
@@ -278,7 +278,9 @@
          *
          * No, we only copy the data up to their requested size.  -- jre
          */
-        memcpy(c, str, str_len);
+       if (str_len > 0) {
+            memcpy(c, str, str_len);
+       }

         c += str_len;
         actual += str_len;

Reply via email to