From d10d08570f61d43e009103c757d387fb17086e7b Mon Sep 17 00:00:00 2001 From: Willy Tarreau Date: Mon, 27 Jul 2026 12:16:30 +0200 Subject: [PATCH] BUG/MINOR: http-htx: check the strdup() of the "lf-string" http reply argument In http_parse_http_reply(), the "lf-string" argument copies its value with strdup() without checking the result: obj = strdup(args[cur_arg]); objlen = strlen(args[cur_arg]); reply->type = HTTP_REPLY_LOGFMT; while every sibling argument does check it ("string", and "lf-file" through its combined "!obj || read(...)" test). is later handed over to parse_logformat_string(), which starts with "lf_expr->str = strdup(fmt)", so a NULL would be passed to strdup() and dereferenced. This only happens if an allocation fails while parsing the configuration, so the impact is limited, but the check is missing where all the others are present. This should be backported to all supported versions. --- src/http_htx.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/src/http_htx.c b/src/http_htx.c index 2bae91c4a..f199265b7 100644 --- a/src/http_htx.c +++ b/src/http_htx.c @@ -1698,6 +1698,10 @@ struct http_reply *http_parse_http_reply(const char **args, int *orig_arg, struc goto error; } obj = strdup(args[cur_arg]); + if (!obj) { + memprintf(errmsg, "out of memory"); + goto error; + } objlen = strlen(args[cur_arg]); reply->type = HTTP_REPLY_LOGFMT; lf_expr_init(&reply->body.fmt); -- 2.47.3