CID 1367528: Security best practices violations (STRING_OVERFLOW): http/HttpTransactHeaders.cc

[zwoop]

*** CID 1367528:  Security best practices violations  (STRING_OVERFLOW)
/proxy/http/HttpTransactHeaders.cc: 820 in HttpTransactHeaders::insert_via_header_in_response(HttpTransact::State *, HTTPHdr *)()
814     
815       char *incoming_via = s->via_string;
816     
817       const char *proto_buf[10]; // 10 seems like a reasonable number of protos to print
818       int retval = s->state_machine->populate_client_protocol(proto_buf, countof(proto_buf));
819       for (int i = 0; i < retval; i++) {
   CID 1367528:  Security best practices violations  (STRING_OVERFLOW)
   You might overrun the 1024-character fixed-size string "via_string" by copying "proto_buf[i]" without checking the length.
820         memcpy(via_string, proto_buf[i], strlen(proto_buf[i]));
821         via_string += strlen(proto_buf[i]);
822         *via_string++ = ' ';
823       }
824     
825       via_string += nstrcpy(via_string, s->http_config_param->proxy_hostname);

[SolidWallOfCode]

I think this is fixed by #2107.