Fix stack buffer overflow issue when calling copy_to_cstr (#2253)

apache · May 18, 2023 · d3de081 · d3de081
1 parent bfb26a1
commit d3de081
Showing 1 changed file with 2 additions and 1 deletion.
diff --git a/src/brpc/input_messenger.cpp b/src/brpc/input_messenger.cpp
@@ -101,7 +101,8 @@ ParseResult InputMessenger::CutInputMessage(
                 return result;
             } else {
                 if (m->_read_buf.size() >= 4) {
-                    char data[PROTO_DUMMY_LEN];
+                    // The length of `data' must be PROTO_DUMMY_LEN + 1 to store extra ending char '\0'
+                    char data[PROTO_DUMMY_LEN + 1];
                     m->_read_buf.copy_to_cstr(data, PROTO_DUMMY_LEN);
                     if (strncmp(data, "RDMA", PROTO_DUMMY_LEN) == 0 &&
                         m->_rdma_state == Socket::RDMA_OFF) {