BUG/MINOR: http-htx: check the strdup() of the "lf-string" http reply argument
In http_parse_http_reply(), the "lf-string" argument copies its value with
strdup() without checking the result:
obj = strdup(args[cur_arg]);
objlen = strlen(args[cur_arg]);
reply->type = HTTP_REPLY_LOGFMT;
while every sibling argument does check it ("string", and "lf-file" through its
combined "!obj || read(...)" test). <obj> is later handed over to
parse_logformat_string(), which starts with "lf_expr->str = strdup(fmt)", so a
NULL would be passed to strdup() and dereferenced.
This only happens if an allocation fails while parsing the configuration, so the
impact is limited, but the check is missing where all the others are present.
This should be backported to all supported versions. W
Willy Tarreau committed
d10d08570f61d43e009103c757d387fb17086e7b
Parent: 449d4e5
Committed by Christopher Faulet <cfaulet@haproxy.com>
on 7/27/2026, 1:49:21 PM