Le 30/10/2026 à 6:39 AM, Martin Mirchev a écrit :
Hi,
Here are three small independent fixes against current master
(e5e52e33c). All three are about values from the configuration or the
CLI that were not checked. The patches are attached (git format-patch).
1/3 BUG/MINOR: tcpcheck: check the number of "hdr" in http-check send
The headers of an "http-check send" rule go into a stack array sized
by tune.http.maxhdr plus a terminator, without any bounds check.
With "tune.http.maxhdr 5" and five "hdr" arguments, "haproxy -c"
segfaults on a release build (ASan: dynamic-stack-buffer-overflow
WRITE). The default of 101 cannot be reached because of the 64-word
line limit. The rule is now rejected with "too many headers".
Backport to all stable versions (since 2.2).
2/3 BUG/MINOR: mjson: fix overread on a path ending with a backslash
plen1()/plen2() skip two characters on a backslash, so a json_query
path ending with one, e.g. json_query($.a\\), makes them read past
the trailing zero. ASan reports a heap-buffer-overflow READ in plen1()
on the first request. The upstream mjson code has the same bug.
Backport to all stable versions (since 2.4).
3/3 BUG/MINOR: stick-table: reject negative gpc/gpt array indexes
strtoul() accepts "-1" and wraps it, so data.gpc[-1] on the CLI and
sc-inc-gpc(-1,0)/sc-set-gpt(-1,0)/sc-add-gpc(-1,0) in the config are
accepted and then silently do nothing or fail as "index out of range".
There is no memory issue, since the index is checked before use. This
is the index counterpart of 1f1b701fe3. Backport to all stable
versions, the CLI part only to 3.2 and above.
Tested on e5e52e33c with an ASan+UBSan build and a release build
(USE_OPENSSL=1 USE_PCRE2=1 USE_ZLIB=1). On master, the reproducers for
1/3 and 2/3 trigger the ASan reports above (1/3 also segfaults on the
release build), and the invalid indexes of 3/3 are accepted. With the
patches, 1/3 and 3/3 give a config or CLI error, and 2/3 returns an
empty result with no ASan report. Paths with escaped separators
($.my\\.key) and array indexes still work. "haproxy -c" gives the same
result before and after on the examples/ configs and on the configs
embedded in the checks, stick-table, stickiness, converter and
sample_fetches reg-tests. I could not run the reg-tests themselves
because I do not have vtest here.
These were found with an LLM-Enhanced Static Analysis Engine and verified
manually.
Martin Mirchev
Thanks, I merged the patch about the tcpcheck. Others seem valid too but don't
cover all cases. I must still review them deeper.
--
Christopher Faulet
