* Initial approach to RESTful controller.

Fix security issues in fstring handling.

1 files changed, 6 insertions, 1 deletions

diff --git a/src/protocol.c b/src/protocol.c
index 4f6e0be38..7df9ae673 100644
--- a/src/protocol.c
+++ b/src/protocol.c
@@ -123,7 +123,7 @@ rspamc_proto_str (guint ver)
 	}
 }
 
-static gchar                    *
+gchar                    *
 separate_command (f_str_t * in, gchar c)
 {
 	guint                            r = 0;
@@ -137,6 +137,11 @@ separate_command (f_str_t * in, gchar c)
 			in->len -= r + 1;
 			return b;
 		}
+		else if (*p == '\0') {
+			/* Actually we cannot allow several \0 characters in string, so write to the log about it */
+			msg_warn ("cannot separate command with \0 character, this can be an attack attempt");
+			return NULL;
+		}
 		p++;
 		r++;
 	}