From: Willy Tarreau <w@1wt.eu>
Date: Mon, 27 Jul 2026 10:16:30 +0000 (+0200)
Subject: BUG/MINOR: http-htx: check the strdup() of the "lf-string" http reply argument
X-Git-Url: http://git.ipfire.org/gitweb/?a=commitdiff_plain;h=d10d08570f61d43e009103c757d387fb17086e7b;p=thirdparty%2Fhaproxy.git

BUG/MINOR: http-htx: check the strdup() of the "lf-string" http reply argument

In http_parse_http_reply(), the "lf-string" argument copies its value with
strdup() without checking the result:

	obj = strdup(args[cur_arg]);
	objlen = strlen(args[cur_arg]);
	reply->type = HTTP_REPLY_LOGFMT;

while every sibling argument does check it ("string", and "lf-file" through its
combined "!obj || read(...)" test). <obj> is later handed over to
parse_logformat_string(), which starts with "lf_expr->str = strdup(fmt)", so a
NULL would be passed to strdup() and dereferenced.

This only happens if an allocation fails while parsing the configuration, so the
impact is limited, but the check is missing where all the others are present.

This should be backported to all supported versions.
---

diff --git a/src/http_htx.c b/src/http_htx.c
index 2bae91c4a..f199265b7 100644
--- a/src/http_htx.c
+++ b/src/http_htx.c
@@ -1698,6 +1698,10 @@ struct http_reply *http_parse_http_reply(const char **args, int *orig_arg, struc
 				goto error;
 			}
 			obj = strdup(args[cur_arg]);
+			if (!obj) {
+				memprintf(errmsg, "out of memory");
+				goto error;
+			}
 			objlen = strlen(args[cur_arg]);
 			reply->type = HTTP_REPLY_LOGFMT;
 			lf_expr_init(&reply->body.fmt);