Skip to content

Commit e57901c

Browse files
shukitchanclaude
andauthored
Zero hdrtoken heap to fix use-of-uninitialized-value (#13172)
The hdrtoken heap allocated in hdrtoken_init() leaves padding bytes between each token's null terminator and the next prefix slot uninitialized, since ink_strlcpy only writes strlen+1 bytes but heap_ptr advances by sstr_len (rounded up to sizeof(HdrTokenHeapPrefix)). Switch to ats_calloc so the padding bytes are zeroed. Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
1 parent 4d4086a commit e57901c

1 file changed

Lines changed: 1 addition & 1 deletion

File tree

src/proxy/hdrs/HdrToken.cc

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -407,7 +407,7 @@ hdrtoken_init()
407407
heap_size += packed_prefix_str_len;
408408
}
409409

410-
_hdrtoken_strs_heap_f = static_cast<const char *>(ats_malloc(heap_size));
410+
_hdrtoken_strs_heap_f = static_cast<const char *>(ats_calloc(1, heap_size));
411411
_hdrtoken_strs_heap_l = _hdrtoken_strs_heap_f + heap_size - 1;
412412

413413
char *heap_ptr = const_cast<char *>(_hdrtoken_strs_heap_f);

0 commit comments

Comments
 (0)