From: Willy Tarreau <w@1wt.eu>
Date: Sat, 31 Oct 2026 07:57:19 +0000 (+0100)
Subject: BUG/MINOR: flt-http-comp: check the block returned by htx_replace_blk_value()
X-Git-Tag: v3.5-dev11~61
X-Git-Url: https://git.kaiwu.me/$%7BISSUES%7D/static/gitweb.js?a=commitdiff_plain;h=a4ecfdd49e95ec412d79815e2fd210100b0c2183;p=haproxy.git

BUG/MINOR: flt-http-comp: check the block returned by htx_replace_blk_value()

comp_http_payload() replaces the value of a DATA block with the deflater's
output and directly passes the result to htx_get_next_blk(), without checking
it. htx_replace_blk_value() returns NULL when htx_prepare_blk_expansion()
finds not enough room for the new value (delta > htx_free_space()). Normally
this cannot happen, but it seldom does during development or improvements
on the compression libraries, and causes crashes that could just be turned
into errors. The decompression code already performs the test, so let's do
the same and stay safe in front of such occasional early bugs. It's not
necessary to backport this since it doesn't trigger with stable code.
---

diff --git a/src/flt_http_comp.c b/src/flt_http_comp.c
index 4e577bd3b..07012b979 100644
--- a/src/flt_http_comp.c
+++ b/src/flt_http_comp.c
@@ -334,6 +334,8 @@ comp_http_payload(struct stream *s, struct filter *filter, struct http_msg *msg,
 					next = htx_remove_blk(htx, blk);
 				else {
 					blk = htx_replace_blk_value(htx, blk, v, ist2(b_head(&trash), b_data(&trash)));
+					if (!blk)
+						goto error;
 					next = htx_get_next_blk(htx, blk);
 				}