[PATCH] Avoid memcpy-from-NULL in apr_brigade_flatten
Ben Kallus <[email protected]>
| Newsgroups | gmane.comp.apache.apr.devel |
|---|---|
| Message-ID | <CAB6pCSZmGWYJ0H1Nt30k9qaLkFN3v6WJVv+Pik+E5KbcS529NA@mail.gmail.com> |
memcpy to or from NULL is undefined behavior, even for copies of
length 0. See this godbolt link for an example of how this can cause
problems: https://gcc.godbolt.org/z/zfvnMMsds
This patch avoids calling memcpy for 0-length buckets, so that buckets
with NULL data and 0 length don't cause UB when flattened.
Addresses this bugzilla report from httpd:
https://bz.apache.org/bugzilla/show_bug.cgi?id=68278
--- apr_brigade-old.c 2023-12-14 21:12:48.616409321 +0000
+++ apr_brigade.c 2023-12-14 21:10:20.477289754 +0000
@@ -278,7 +278,9 @@
*
* No, we only copy the data up to their requested size. -- jre
*/
- memcpy(c, str, str_len);
+ if (str_len > 0) {
+ memcpy(c, str, str_len);
+ }
c += str_len;
actual += str_len;