b00f02d75e
Backport upstream fix for CVE-2026-55204 to haproxy 1.8.27.
The patch adds a missing NULL check after the third call to
hpack_dht_defrag() in hpack_dht_insert() (src/hpack-tbl.c),
preventing a NULL pointer dereference (SIGSEGV) when
pool_head_hpack_tbl is exhausted.
CVE: CVE-2026-55204
Upstream patches:
- 9a6d1fe3f0.patch
Resolves: RHEL-211083
This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent.
Assisted-by: Ymir
38 lines
1.4 KiB
Diff
38 lines
1.4 KiB
Diff
From 051642064150cdf6dab3b3cd57f59c3937c522bd Mon Sep 17 00:00:00 2001
|
|
From: Tristan Madani <tristan@talencesecurity.com>
|
|
Date: Tue, 16 Jun 2026 10:42:10 +0200
|
|
Subject: [PATCH] BUG/MINOR: hpack-tbl: add missing NULL check after
|
|
hpack_dht_defrag()
|
|
|
|
hpack_dht_insert() has three call sites for hpack_dht_defrag(). Two of
|
|
them (lines 293 and 306) correctly check for a NULL return and bail out
|
|
with -1. The third (line 353, data-space defrag path) assigns the return
|
|
value to dht and immediately dereferences it without a NULL check.
|
|
|
|
When pool_head_hpack_tbl is exhausted, hpack_dht_alloc() returns NULL,
|
|
hpack_dht_defrag() propagates it, and line 354 dereferences NULL+0x0a
|
|
(offsetof wrap), crashing the worker with SIGSEGV.
|
|
|
|
Add a NULL check consistent with the two other call sites.
|
|
|
|
This must be backported to all stable versions.
|
|
|
|
Reported-by: Tristan (@TristanInSec)
|
|
---
|
|
src/hpack-tbl.c | 2 ++
|
|
1 file changed, 2 insertions(+)
|
|
|
|
diff --git a/src/hpack-tbl.c b/src/hpack-tbl.c
|
|
index 9ead9e8..1da1544 100644
|
|
--- a/src/hpack-tbl.c
|
|
+++ b/src/hpack-tbl.c
|
|
@@ -359,6 +359,8 @@ int hpack_dht_insert(struct hpack_dht *dht, struct ist name, struct ist value)
|
|
else {
|
|
/* need to defragment the table before inserting upfront */
|
|
dht = hpack_dht_defrag(dht);
|
|
+ if (!dht)
|
|
+ return -1;
|
|
wrap = dht->wrap + 1;
|
|
head = dht->head + 1;
|
|
dht->dte[head].addr = dht->dte[dht->front].addr - (name.len + value.len);
|