Mailing List Archive

commit 247eb50f47d4dae5eeacc54375eb3f2adde086a1
Author: Dridi Boukelmoune <dridi.boukelmoune@gmail.com>
Date: Mon Jan 3 18:36:16 2022 +0100

vrt: Perform IP to STRING conversion on the stack

Performing the conversion on the stack could lead to a buffer too small
to store the string representation of the IP address. There is no test
case because the error handling is output to stderr.

Refs #3765

diff --git a/bin/varnishd/cache/cache_vrt.c b/bin/varnishd/cache/cache_vrt.c
index df7440ad8..b4e61008c 100644
--- a/bin/varnishd/cache/cache_vrt.c
+++ b/bin/varnishd/cache/cache_vrt.c
@@ -720,23 +720,18 @@ VRT_r_now(VRT_CTX)
VCL_STRING v_matchproto_()
VRT_IP_string(VRT_CTX, VCL_IP ip)
{
- char *p;
- unsigned len;
+ char buf[VTCP_ADDRBUFSIZE];
+ struct vsb vsb[1];

CHECK_OBJ_NOTNULL(ctx, VRT_CTX_MAGIC);
if (ip == NULL) {
VRT_fail(ctx, "%s: Illegal IP", __func__);
return (NULL);
}
- len = WS_ReserveAll(ctx->ws);
- if (len == 0) {
- WS_Release(ctx->ws, 0);
- return (NULL);
- }
- p = WS_Reservation(ctx->ws);
- VTCP_name(ip, p, len, NULL, 0);
- WS_Release(ctx->ws, strlen(p) + 1);
- return (p);
+ VTCP_name(ip, buf, sizeof buf, NULL, 0);
+ WS_VSB_new(vsb, ctx->ws);
+ VSB_cat(vsb, buf);
+ return (WS_VSB_finish(vsb, ctx->ws, NULL));
}

int
_______________________________________________
varnish-commit mailing list
varnish-commit@varnish-cache.org
https://www.varnish-cache.org/lists/mailman/listinfo/varnish-commit