From: Christopher Faulet Date: Fri, 11 Sep 2026 07:51:11 +0000 (+0200) Subject: BUG/MEDIUM: cli: Don't parse next command if input buffer is empty X-Git-Tag: v3.5-dev7~30 X-Git-Url: https://git.kaiwu.me/?a=commitdiff_plain;h=42aec4151b61d42ef39fd0b808c88245e452c03c;p=haproxy.git BUG/MEDIUM: cli: Don't parse next command if input buffer is empty In the loop of the command line parser, we always tried to get the next command, even when the input buffer was empty. However it was an issue if the size of command line was exactly the buffer size and it was finished by a payload pattern. In that case, an attempt to allocate a dynamic buffer for the payload was performed with a size of 0, which led to a crash. To fix the issue, the loop is now interrupted with there is no more data to parse in the input buffer. This way, when an dynamic buffer must be (re)allocated, we are sure its size will never be 0. To be sure it is true, a BUG_ON() was added on the new dynamic buffer size. To mitigate the issue, "tune.cli.max-payload-size" parameter can be set to 0. This patch must be backported to 3.4. --- diff --git a/src/cli.c b/src/cli.c index 73a1df94c..fafad7c83 100644 --- a/src/cli.c +++ b/src/cli.c @@ -1009,6 +1009,8 @@ int cli_try_realloc_payload(struct appctx *appctx, struct buffer *buf, size_t ne { char *old, *new; + BUG_ON(new_size == 0); + if (new_size > appctx->cli_ctx.max_payload_sz) new_size = appctx->cli_ctx.max_payload_sz; @@ -1049,6 +1051,9 @@ int cli_parse_cmdline(struct appctx *appctx) while (1) { struct buffer *buf; + if (!b_data(&appctx->inbuf)) + break; + /* payload doesn't take escapes nor does it end on semi-colons, * so we use the regular getline. Normal mode however must stop * on LFs and semi-colons that are not prefixed by a backslash.