masaori335 opened a new pull request, #13887:
URL: https://github.com/apache/trafficserver/pull/13887
# Motivation
`Instance::AddPlugin()` loads a remap plugin from inside a Cript.
`Plugin::Remap::Create()` allocates its argv with
`options.size() + 1` slots and then writes `options.size() + 2` (from URL,
to URL, then every option). So every call
writes one pointer past the end of the heap array. The plugin is also told
`argc = options.size() + 1`, so it
never sees its last option.
The example in the docs triggers both:
```cpp
instance.AddPlugin("my_ratelimit", "rate_limit.so", {"--limit=300",
"--error=429"});
```
The write goes past the array, and `rate_limit` never sees `--error=429`.
The bug has been there since cripts was
imported (`bf3ca03b6e`).
# Approach
Build argv as a `std::vector<const char *>` and pass its `size()`, so the
count and the array cannot disagree.
This also removes the `new[]`/`delete[]` pair.
# Testing
New `sub_plugin.cript` case in `cripts_bundle` (urtest): it loads
`header_rewrite` with two rules files, each
setting one header, and checks that the origin sees both. Without the fix,
`X-Sub-Plugin-First` arrives and
`X-Sub-Plugin-Last` is absent.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
