From: Willy Tarreau <w@1wt.eu>
Date: Thu, 12 Nov 2026 14:12:06 +0000 (+0100)
Subject: BUG/MINOR: acl: check the presence of an argument to "-u"
X-Git-Tag: v3.5-dev12~21
X-Git-Url: https://git.kaiwu.me/ngx_http_flv_module.html?a=commitdiff_plain;h=d729a03dc8e4eabb250bc5d1a094c2a6c0858477;p=haproxy.git

BUG/MINOR: acl: check the presence of an argument to "-u"

In 1.5-dev23, support for specifying an ACL unique ID was added via
commit 3534d881bc ("MINOR: pattern/acl: Each pattern of each acl can
be load with specified id"). It turns out that if the argument is
missing, we read past the end and can segfault.

This can be backported to all versions. Thanks to Zlatko Bratkovic
for reporting this bug.
---

diff --git a/src/acl.c b/src/acl.c
index f03c065dc..7b1990aaf 100644
--- a/src/acl.c
+++ b/src/acl.c
@@ -331,7 +331,7 @@ struct acl_expr *parse_acl_expr(const char **args, char **err, struct arg_list *
 			patflags |= PAT_MF_NO_DNS;
 		else if (strcmp(*args, "-u") == 0) {
 			unique_id = strtol(args[1], &error, 10);
-			if (*error != '\0') {
+			if (!*args[1] || *error != '\0') {
 				memprintf(err, "the argument of -u must be an integer");
 				goto out_free_expr;
 			}