The branch stable/15 has been updated by des: URL: https://cgit.FreeBSD.org/src/commit/?id=2581bc3af3815e92b0eef44bee224fff92931de8
commit 2581bc3af3815e92b0eef44bee224fff92931de8 Author: Glen Barber <[email protected]> AuthorDate: 2026-09-03 07:51:28 +0000 Commit: Dag-Erling Smørgrav <[email protected]> CommitDate: 2026-09-03 11:56:38 +0000 hastd: Fix crash on empty message A HAST message can be empty, in which case ebuf_add_tail() does nothing and ebuf_data() returns NULL because the size of the ebuf is zero, but hast_proto_recv_hdr() asserts that the return value is not NULL, resulting in an immediate crash if hastctl or hastd receive an empty message. This is trivially reproducable by running `hastctl status` or `hastctl role init` (as the rc script does prior to stopping hastd). To avoid this, don't try to grow the ebuf or receive additional data if the header size is zero. PR: 298085 MFC after: 3 days Reviewed by: kevans, gjb Differential Revision: https://reviews.freebsd.org/D59306 (cherry picked from commit 8646d65b45339642d4aab1de35a2bc79fc45f09e) --- sbin/hastd/hast_proto.c | 14 ++++++++------ 1 file changed, 8 insertions(+), 6 deletions(-) diff --git a/sbin/hastd/hast_proto.c b/sbin/hastd/hast_proto.c index d9f231e7b007..fc90bf59dc8a 100644 --- a/sbin/hastd/hast_proto.c +++ b/sbin/hastd/hast_proto.c @@ -150,12 +150,14 @@ hast_proto_recv_hdr(const struct proto_conn *conn, struct nv **nvp) eb = ebuf_alloc(hdr.size); if (eb == NULL) goto fail; - if (ebuf_add_tail(eb, NULL, hdr.size) == -1) - goto fail; - hptr = ebuf_data(eb, NULL); - PJDLOG_ASSERT(hptr != NULL); - if (proto_recv(conn, hptr, hdr.size) == -1) - goto fail; + if (hdr.size > 0) { + if (ebuf_add_tail(eb, NULL, hdr.size) == -1) + goto fail; + hptr = ebuf_data(eb, NULL); + PJDLOG_ASSERT(hptr != NULL); + if (proto_recv(conn, hptr, hdr.size) == -1) + goto fail; + } nv = nv_ntoh(eb); if (nv == NULL) goto fail;
