From: David Carlier <[email protected]>
The user-agent string copy had an off-by-one error: the buffer size
limit did not account for the null terminator, and the memcpy length
used i-1 which truncated the last character of the user-agent string.
This should be backported to lower branches.
---
addons/deviceatlas/da.c | 13 +++++--------
1 file changed, 5 insertions(+), 8 deletions(-)
diff --git a/addons/deviceatlas/da.c b/addons/deviceatlas/da.c
index d40041a6a..3532c5541 100644
--- a/addons/deviceatlas/da.c
+++ b/addons/deviceatlas/da.c
@@ -393,8 +393,7 @@ static int da_haproxy_conv(const struct arg *args, struct
sample *smp, void *pri
{
da_deviceinfo_t devinfo;
da_status_t status;
- const char *useragent;
- char useragentbuf[1024] = { 0 };
+ char useragentbuf[1024];
int i;
if (global_deviceatlas.daset == 0 || smp->data.u.str.data == 0) {
@@ -403,14 +402,12 @@ static int da_haproxy_conv(const struct arg *args, struct
sample *smp, void *pri
da_haproxy_checkinst();
- i = smp->data.u.str.data > sizeof(useragentbuf) ? sizeof(useragentbuf)
: smp->data.u.str.data;
- memcpy(useragentbuf, smp->data.u.str.area, i - 1);
- useragentbuf[i - 1] = 0;
-
- useragent = (const char *)useragentbuf;
+ i = smp->data.u.str.data > sizeof(useragentbuf) - 1 ?
sizeof(useragentbuf) - 1 : smp->data.u.str.data;
+ memcpy(useragentbuf, smp->data.u.str.area, i);
+ useragentbuf[i] = 0;
status = da_search(&global_deviceatlas.atlas, &devinfo,
- global_deviceatlas.useragentid, useragent, 0);
+ global_deviceatlas.useragentid, useragentbuf, 0);
return status != DA_OK ? 0 : da_haproxy(args, smp, &devinfo);
}
--
2.51.0