From: Frederic Lecaille <flecaille@haproxy.com>
Date: Tue, 15 Sep 2026 12:08:18 +0000 (+0200)
Subject: BUG/MINOR: ssl: reject a \0 byte in ssl_fc_npn
X-Git-Url: https://git.kaiwu.me/?a=commitdiff_plain;h=refs%2Fheads%2F20260911-embedded-nul-char;p=haproxy.git

BUG/MINOR: ssl: reject a \0 byte in ssl_fc_npn

A string sample cannot contain a \0 byte, but ssl_fc_npn returned the
NPN protocol name as sent by the client, which OpenSSL stores without
checking it against the configured list, so a client could put a \0 in
it. Such a value was then matched by "-m str" on its prefix.

Fail the fetch when the name holds a \0 byte. This only applies when
"npn" is set on the bind line.

This must be backported to all stable branches.
---

diff --git a/src/ssl_sample.c b/src/ssl_sample.c
index 2725b67eb..1a6c472e4 100644
--- a/src/ssl_sample.c
+++ b/src/ssl_sample.c
@@ -1917,6 +1917,10 @@ smp_fetch_ssl_fc_npn(const struct arg *args, struct sample *smp, const char *kw,
 	if (!smp->data.u.str.area)
 		return 0;
 
+	/* a string sample cannot contain a NUL byte */
+	if (memchr(smp->data.u.str.area, 0, len))
+		return 0;
+
 	smp->data.u.str.data = len;
 	return 1;
 }