BUG/MINOR: spoe: fix off-by-one length in UUID format string
authorWilly Tarreau <w@1wt.eu>
Tue, 29 Oct 2019 09:25:49 +0000 (10:25 +0100)
committerWilly Tarreau <w@1wt.eu>
Tue, 29 Oct 2019 09:33:13 +0000 (10:33 +0100)
The per-thread UUID string produced by generate_pseudo_uuid() could be
off by one character due to too small of size limit in snprintf(). In
practice the UUID remains large enough to avoid any collision though.

This should be backported to 2.0 and 1.9.

src/flt_spoe.c

index fe219ea..f23cafe 100644 (file)
@@ -276,7 +276,7 @@ generate_pseudo_uuid()
                last >>= 32u;
                bits  -= 32;
        }
-       snprintf(uuid, 36, "%8.8x-%4.4x-%4.4x-%4.4x-%12.12llx",
+       snprintf(uuid, 37, "%8.8x-%4.4x-%4.4x-%4.4x-%12.12llx",
                             rnd[0],
                             rnd[1] & 0xFFFF,
                             ((rnd[1] >> 16u) & 0xFFF) | 0x4000,  // highest 4 bits indicate the uuid version