From a4ecfdd49e95ec412d79815e2fd210100b0c2183 Mon Sep 17 00:00:00 2001 From: Willy Tarreau Date: Sat, 31 Oct 2026 08:57:19 +0100 Subject: [PATCH] BUG/MINOR: flt-http-comp: check the block returned by htx_replace_blk_value() comp_http_payload() replaces the value of a DATA block with the deflater's output and directly passes the result to htx_get_next_blk(), without checking it. htx_replace_blk_value() returns NULL when htx_prepare_blk_expansion() finds not enough room for the new value (delta > htx_free_space()). Normally this cannot happen, but it seldom does during development or improvements on the compression libraries, and causes crashes that could just be turned into errors. The decompression code already performs the test, so let's do the same and stay safe in front of such occasional early bugs. It's not necessary to backport this since it doesn't trigger with stable code. --- src/flt_http_comp.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/src/flt_http_comp.c b/src/flt_http_comp.c index 4e577bd3b..07012b979 100644 --- a/src/flt_http_comp.c +++ b/src/flt_http_comp.c @@ -334,6 +334,8 @@ comp_http_payload(struct stream *s, struct filter *filter, struct http_msg *msg, next = htx_remove_blk(htx, blk); else { blk = htx_replace_blk_value(htx, blk, v, ist2(b_head(&trash), b_data(&trash))); + if (!blk) + goto error; next = htx_get_next_blk(htx, blk); } -- 2.47.3