From 2b84d850708b5ae2677f58cb0ffed481d0015263 Mon Sep 17 00:00:00 2001
From: Aleksei Bavshin <a.bavshin@f5.com>
Date: Mon, 6 Oct 2025 14:56:29 -0700
Subject: [PATCH] Conf: ensure that the default path is NUL-terminated.

`ngx_conf_merge_path_value` takes care of that when it reallocates a
resolved relative path, but the reallocation is skipped if we pass an
absolute path with `NGX_ACME_STATE_PREFIX`.
---
 src/conf/issuer.rs | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/src/conf/issuer.rs b/src/conf/issuer.rs
index 06ee5c4..23c2d2e 100644
--- a/src/conf/issuer.rs
+++ b/src/conf/issuer.rs
@@ -331,7 +331,7 @@ impl Issuer {
 
 fn default_state_path(cf: &mut ngx_conf_t, name: &ngx_str_t) -> Result<ngx_str_t, AllocError> {
     let mut path = Vec::new_in(cf.pool());
-    let reserve = "acme_".len() + name.len;
+    let reserve = "acme_".len() + name.len + 1;
 
     if let Some(p) = core::option_env!("NGX_ACME_STATE_PREFIX") {
         let p = p.trim_end_matches('/');
@@ -344,9 +344,10 @@ fn default_state_path(cf: &mut ngx_conf_t, name: &ngx_str_t) -> Result<ngx_str_t
     path.try_reserve_exact(reserve).map_err(|_| AllocError)?;
     path.extend(b"acme_");
     path.extend(name.as_bytes());
+    path.push(b'\0');
 
     let (data, len, _) = path.into_raw_parts();
-    Ok(ngx_str_t { data, len })
+    Ok(ngx_str_t { data, len: len - 1 })
 }
 
 #[derive(Debug, thiserror::Error)]