[openssl/openssl] b298b4: demos/http3: fix missing NUL terminator on h3ssl->url

  Branch: refs/heads/master
  Home:   https://github.com/openssl/openssl
  Commit: b298b4446601301316718e9cd4fc3ecb9856ea8d
      https://github.com/openssl/openssl/commit/b298b4446601301316718e9cd4fc3ecb9856ea8d
  Author: Shmael13 <[email protected]>
  Date:   2026-06-21 (Sun, 21 Jun 2026)

  Changed paths:
    M demos/http3/ossl-nghttp3-demo-server.c

  Log Message:
  -----------
  demos/http3: fix missing NUL terminator on h3ssl->url

In the HTTP/3 demo server's :path handler, when the path value does not
begin with '/', the value is copied into the fixed-size url[MAXURL]
buffer with memcpy(h3ssl->url, vvalue.base, len) and no terminator is
written. len is capped at MAXURL, so a :path value of MAXURL or more
bytes fills the entire buffer, overwriting the zeroes from the preceding
memset and leaving url without a NUL terminator. The buffer is later
used as a C string by strcat() and strcmp() when building the file name,
resulting in a heap out-of-bounds read and a possible overflow of the
filename[PATH_MAX] buffer. This is reachable from a client-supplied
:path header.

Cap the length at MAXURL - 1 so that the trailing byte zeroed by the
memset always remains, guaranteeing url is NUL-terminated in every
branch. The '/'-prefixed branches are unaffected as they already write
an explicit terminator within the smaller bound.

Fixes #31516

Reviewed-by: Tim Hudson <[email protected]>
Reviewed-by: Norbert Pocs <[email protected]>
Reviewed-by: Nikola Pajkovsky <[email protected]>
Reviewed-by: Neil Horman <[email protected]>
MergeDate: Sun Jun 21 16:19:08 2026
(Merged from https://github.com/openssl/openssl/pull/31520)



To unsubscribe from these emails, change your notification settings at https://github.com/openssl/openssl/settings/notifications

-- 
You received this message because you are subscribed to the Google Groups "openssl-commits" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [email protected].
To view this discussion visit https://groups.google.com/a/openssl.org/d/msgid/openssl-commits/openssl/openssl/push/refs/heads/master/bb3d8b-b298b4%40github.com.