Fix dynamic-stack-buffer-overflow of cachekey plugin (apache#7945)

* Fix dynamic-stack-buffer-overflow of cachekey plugin * Check dst_size include null termination (cherry picked from commit 5a9339d) (cherry picked from commit b3b7db7)
masaori335 · Jun 22, 2021 · 887f4ec · 887f4ec
1 parent 2130c96
commit 887f4ec
Show file tree

Hide file tree

Showing 2 changed files with 2 additions and 2 deletions.
diff --git a/plugins/cachekey/cachekey.cc b/plugins/cachekey/cachekey.cc
@@ -41,7 +41,7 @@ appendEncoded(String &target, const char *s, size_t len)
     return;
   }
 
-  char tmp[len * 2];
+  char tmp[len * 3 + 1];
   size_t written;
 
   /* The default table does not encode the comma, so we need to use our own table here. */

diff --git a/proxy/logging/LogUtils.cc b/proxy/logging/LogUtils.cc
@@ -360,7 +360,7 @@ escapify_url_common(Arena *arena, char *url, size_t len_in, int *len_out, char *
   //
   size_t out_len = len_in + 2 * count;
 
-  if (dst && out_len > dst_size) {
+  if (dst && (out_len + 1) > dst_size) {
     *len_out = 0;
     return nullptr;
   }