Copilot commented on code in PR #13552:
URL: https://github.com/apache/trafficserver/pull/13552#discussion_r3788628536
##########
src/proxy/http/remap/RemapYamlConfig.cc:
##########
@@ -388,7 +388,9 @@ parse_map_referer(const YAML::Node &node, url_mapping
*url_mapping)
!strcasecmp(url.c_str(), "<default_redirect_url>") ||
!strcasecmp(url.c_str(), "default_redirect_url")) {
url_mapping->default_redirect_url = true;
}
- url_mapping->redir_chunk_list =
redirect_tag_str::parse_format_redirect_url(ats_strdup(url.c_str()));
+ // parse_format_redirect_url() copies what it needs out of the buffer, so
hand it the local
+ // string's storage rather than a fresh allocation that nothing would own.
+ url_mapping->redir_chunk_list =
redirect_tag_str::parse_format_redirect_url(url.data());
Review Comment:
Passing std::string::data() directly is unsafe here because
parse_format_redirect_url() temporarily writes NULs into the provided buffer
(UrlMapping.cc:171-175). When no '%' is present, it will write to the
terminating NUL at url.data()[url.size()], which is not guaranteed to be a
writable element of the string. Use a separate mutable, NUL-terminated buffer
for the parse call to avoid undefined behavior.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
