BUG/MINOR: http-htx: check the strdup() of the "lf-string" http reply argument

In http_parse_http_reply(), the "lf-string" argument copies its value with
strdup() without checking the result:

	obj = strdup(args[cur_arg]);
	objlen = strlen(args[cur_arg]);
	reply->type = HTTP_REPLY_LOGFMT;

while every sibling argument does check it ("string", and "lf-file" through its
combined "!obj || read(...)" test). <obj> is later handed over to
parse_logformat_string(), which starts with "lf_expr->str = strdup(fmt)", so a
NULL would be passed to strdup() and dereferenced.

This only happens if an allocation fails while parsing the configuration, so the
impact is limited, but the check is missing where all the others are present.

This should be backported to all supported versions.

diff --git a/src/http_htx.c b/src/http_htx.c
index 2bae91c4a8bde1cd4dda9452b24aea4613f13f66..f199265b7a88babfabdb743e51eadf09656748b0 100644 (file)
--- a/src/http_htx.c
+++ b/src/http_htx.c
@@ -1698,6 +1698,10 @@ struct http_reply *http_parse_http_reply(const char **args, int *orig_arg, struc
                                goto error;
                        }
                        obj = strdup(args[cur_arg]);
+                       if (!obj) {
+                               memprintf(errmsg, "out of memory");
+                               goto error;
+                       }
                        objlen = strlen(args[cur_arg]);
                        reply->type = HTTP_REPLY_LOGFMT;
                        lf_expr_init(&reply->body.fmt);