Skip to content

Commit 9a6d1fe

Browse files
Tristan Madania-denoyelle
authored andcommitted
BUG/MINOR: hpack-tbl: add missing NULL check after hpack_dht_defrag()
hpack_dht_insert() has three call sites for hpack_dht_defrag(). Two of them (lines 293 and 306) correctly check for a NULL return and bail out with -1. The third (line 353, data-space defrag path) assigns the return value to dht and immediately dereferences it without a NULL check. When pool_head_hpack_tbl is exhausted, hpack_dht_alloc() returns NULL, hpack_dht_defrag() propagates it, and line 354 dereferences NULL+0x0a (offsetof wrap), crashing the worker with SIGSEGV. Add a NULL check consistent with the two other call sites. This must be backported to all stable versions. Reported-by: Tristan (@TristanInSec)
1 parent 8e1c513 commit 9a6d1fe

1 file changed

Lines changed: 2 additions & 0 deletions

File tree

src/hpack-tbl.c

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -351,6 +351,8 @@ int hpack_dht_insert(struct hpack_dht *dht, struct ist name, struct ist value)
351351
else {
352352
/* need to defragment the table before inserting upfront */
353353
dht = hpack_dht_defrag(dht);
354+
if (!dht)
355+
return -1;
354356
wrap = dht->wrap + 1;
355357
head = dht->head + 1;
356358
dht->dte[head].addr = dht->dte[dht->front].addr - (name.len + value.len);

0 commit comments

Comments
 (0)