]> git.ipfire.org Git - thirdparty/haproxy.git/commit
BUG/MINOR: qpack: fix potential null-pointer dereference in qpack_dht_insert()
authorFrederic Lecaille <flecaille@haproxy.com>
Wed, 27 May 2026 13:00:30 +0000 (15:00 +0200)
committerFrederic Lecaille <flecaille@haproxy.com>
Wed, 27 May 2026 16:40:53 +0000 (18:40 +0200)
commit2f20eb5bd8d9989b37119666935bb27285acf77e
treef05e918098a2ee7a9d6dffb27608e6e0864b17be
parent40313cd0d5ca88af2e9cc8a11a25acd4ff9a62c9
BUG/MINOR: qpack: fix potential null-pointer dereference in qpack_dht_insert()

When defragmenting the QPACK dynamic header table upfront during an
insertion, qpack_dht_defrag() can fail and return NULL if memory
allocation or re-allocation fails.

However, qpack_dht_insert() was blindly using the returned pointer
without validation, immediately leading to a null-pointer dereference
on 'dht->wrap'.

Fix this by checking if 'dht' is NULL after the defrag call and return
an error (-1).

Note that this has no impact on production yet because the QPACK dynamic
table is currently not enabled/used, so qpack_dht_insert() is never called.

Should be easily backported to all versions.
src/qpack-tbl.c