Re: [PATCH 09/10] BUG: compression: fix heap overflow from SLZ output expansion

[Christopher Faulet]

Le 09/04/2026 à 1:00 PM, Greg Kroah-Hartman a écrit :
But did you miss the check for htx_replace_blk_value() that this patch
had in comp_http_payload(), pasted here in a whitespace damaged way:
@@ -330,6 +338,8 @@ comp_http_payload(struct stream *s, struct filter *filter, 
struct http_msg *msg,
                                         next = htx_remove_blk(htx, blk);
                                 else {
                                         blk = htx_replace_blk_value(htx, blk, v, 
ist2(b_head(&trash), b_data(&trash)));
+                                       if (!blk)
+                                               goto error;
                                         next = htx_get_next_blk(htx, blk);
                                 }

At first glance, I would say the replace cannot fail. However, it is probably 
safer to add the test. At least to prevent any bug if the API change. Do you 
want to submit a new patch ?

--
Christopher Faulet