From: Denis V. Lunev <[email protected]>
qio_channel_websock_extract_headers() returns 0 without queueing a
response when the request line contains no space, unlike every sibling
check which jumps to bad_request. encoutput stays empty, yet
qio_channel_websock_handshake_read() still reports success and the
caller arms a G_IO_OUT watch to flush nothing.
Flushing that empty buffer is where QEMU crashes. Any client can
trigger it before authentication on a VNC websocket port:
printf 'stats\r\nx\r\n\r\n' | nc $host $port
Fixes: 07e95cd529af ("io: fully parse & validate HTTP headers for websocket
protocol handshake")
Fixes: f69a8bde2935 ("io: send proper HTTP response for websocket errors")
Fixes: CVE-2026-84788
Cc: [email protected]
Cc: Daniel P. Berrangé <[email protected]>
Cc: Marc-André Lureau <[email protected]>
Reviewed-by: Daniel P. Berrangé <[email protected]>
Reviewed-by: Marc-André Lureau <[email protected]>
Signed-off-by: Denis V. Lunev <[email protected]>
Signed-off-by: Daniel P. Berrangé <[email protected]>
---
io/channel-websock.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/io/channel-websock.c b/io/channel-websock.c
index 1929abf56a..66c91ed2a2 100644
--- a/io/channel-websock.c
+++ b/io/channel-websock.c
@@ -230,7 +230,7 @@ qio_channel_websock_extract_headers(QIOChannelWebsock *ioc,
tmp = strchr(buffer, ' ');
if (!tmp) {
error_setg(errp, "Missing HTTP path delimiter");
- return 0;
+ goto bad_request;
}
*tmp = '\0';
--
2.55.0
