From: Willy Tarreau <w@1wt.eu>
Date: Mon, 27 Jul 2026 08:02:22 +0000 (+0200)
Subject: BUG/MINOR: http-htx: check the trash allocation in http_scheme_based_normalize()
X-Git-Url: http://git.ipfire.org/gitweb/?a=commitdiff_plain;h=be0951be28b930744355f91b5116762c0365196e;p=thirdparty%2Fhaproxy.git

BUG/MINOR: http-htx: check the trash allocation in http_scheme_based_normalize()

http_scheme_based_normalize() uses a trash chunk to rebuild the target URI when
the default port must be dropped or when an empty path must be replaced by "/",
but it does not test the allocation:

	struct buffer *temp = alloc_trash_chunk();
	struct ist meth, vsn;

	/* meth */
	chunk_memcat(temp, HTX_SL_REQ_MPTR(sl), HTX_SL_REQ_MLEN(sl));

alloc_trash_chunk() takes its memory from pool_head_trash and returns NULL when
the pool is exhausted, in which case chunk_memcat() dereferences NULL and the
worker crashes. All the other users of alloc_trash_chunk() in the HTTP code
(http_act.c, http_ana.c) do test the result.

Normalization is performed on every absolute-form request URI (from H1, H2 and
H3), so this is reachable under memory pressure. Let's simply report a failure,
which the callers already handle as a rewrite error.

This was introduced by commit 4c0882b1b ("MEDIUM: http: implement scheme-based
normalization") in 2.5-dev2, so it should be backported to all supported
versions.
---

diff --git a/src/http_htx.c b/src/http_htx.c
index 422fbe83c..2bae91c4a 100644
--- a/src/http_htx.c
+++ b/src/http_htx.c
@@ -1880,6 +1880,9 @@ int http_scheme_based_normalize(struct htx *htx)
 		struct buffer *temp = alloc_trash_chunk();
 		struct ist meth, vsn;
 
+		if (!temp)
+			goto fail;
+
 		/* meth */
 		chunk_memcat(temp, HTX_SL_REQ_MPTR(sl), HTX_SL_REQ_MLEN(sl));
 		meth = ist2(temp->area, HTX_SL_REQ_MLEN(sl));