From bda6c07813565ae5314331398c098b730fa44e2a Mon Sep 17 00:00:00 2001
From: "Adam C. Emerson" <aemerson@redhat.com>
Date: Tue, 24 Mar 2026 18:21:30 -0400
Subject: [PATCH] rgw/cors: Remove VLA from `lowercase_http_attr`

Signed-off-by: Adam C. Emerson <aemerson@redhat.com>
---
 src/rgw/rgw_cors.cc | 17 ++++++++---------
 1 file changed, 8 insertions(+), 9 deletions(-)

diff --git a/src/rgw/rgw_cors.cc b/src/rgw/rgw_cors.cc
index 049e0ab0eac..a7305fff721 100644
--- a/src/rgw/rgw_cors.cc
+++ b/src/rgw/rgw_cors.cc
@@ -95,16 +95,15 @@ list<RGWCORSRule> RGWCORSRule::generate_test_instances()
  *
  * @todo When UTF-8 is allowed in HTTP headers, this function will need to change
  */
-string lowercase_http_attr(const string& orig)
+std::string
+lowercase_http_attr(const std::string& orig)
 {
-  const char *s = orig.c_str();
-  char buf[orig.size() + 1];
-  buf[orig.size()] = '\0';
-
-  for (size_t i = 0; i < orig.size(); ++i, ++s) {
-	buf[i] = tolower(*s);
-  }
-  return string(buf);
+  std::string s;
+  s.reserve(orig.size());
+  std::ranges::transform(orig, std::back_inserter(s), [](char c) -> char {
+    return tolower(static_cast<unsigned char>(c));
+  });
+  return s;
 }
 
 
-- 
2.47.3