SIGN IN SIGN UP

BUG/MINOR: http-htx: check the trash allocation in http_scheme_based_normalize()

http_scheme_based_normalize() uses a trash chunk to rebuild the target URI when
the default port must be dropped or when an empty path must be replaced by "/",
but it does not test the allocation:

	struct buffer *temp = alloc_trash_chunk();
	struct ist meth, vsn;

	/* meth */
	chunk_memcat(temp, HTX_SL_REQ_MPTR(sl), HTX_SL_REQ_MLEN(sl));

alloc_trash_chunk() takes its memory from pool_head_trash and returns NULL when
the pool is exhausted, in which case chunk_memcat() dereferences NULL and the
worker crashes. All the other users of alloc_trash_chunk() in the HTTP code
(http_act.c, http_ana.c) do test the result.

Normalization is performed on every absolute-form request URI (from H1, H2 and
H3), so this is reachable under memory pressure. Let's simply report a failure,
which the callers already handle as a rewrite error.

This was introduced by commit 4c0882b1b ("MEDIUM: http: implement scheme-based
normalization") in 2.5-dev2, so it should be backported to all supported
versions.
W
Willy Tarreau committed
be0951be28b930744355f91b5116762c0365196e
Parent: 3e66606
Committed by Christopher Faulet <cfaulet@haproxy.com> on 7/27/2026, 1:29:01 PM