From d729a03dc8e4eabb250bc5d1a094c2a6c0858477 Mon Sep 17 00:00:00 2001 From: Willy Tarreau Date: Thu, 12 Nov 2026 15:12:06 +0100 Subject: [PATCH] BUG/MINOR: acl: check the presence of an argument to "-u" In 1.5-dev23, support for specifying an ACL unique ID was added via commit 3534d881bc ("MINOR: pattern/acl: Each pattern of each acl can be load with specified id"). It turns out that if the argument is missing, we read past the end and can segfault. This can be backported to all versions. Thanks to Zlatko Bratkovic for reporting this bug. --- src/acl.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/acl.c b/src/acl.c index f03c065dc..7b1990aaf 100644 --- a/src/acl.c +++ b/src/acl.c @@ -331,7 +331,7 @@ struct acl_expr *parse_acl_expr(const char **args, char **err, struct arg_list * patflags |= PAT_MF_NO_DNS; else if (strcmp(*args, "-u") == 0) { unique_id = strtol(args[1], &error, 10); - if (*error != '\0') { + if (!*args[1] || *error != '\0') { memprintf(err, "the argument of -u must be an integer"); goto out_free_expr; } -- 2.47.3