From 6515c4104fadc7c6cf11b67ee89f8fbbfc7af461 Mon Sep 17 00:00:00 2001 From: tb Date: Thu, 2 Apr 2026 13:35:36 +0000 Subject: [PATCH] relayd: error check bsearch in relay_httperror_byid() If relay_httperror_byid() is passed a HTTP error code not in the table this would result in a NULL deref. The intent is that the code fall back to "Unknown error" on NULL return. From Jan Schreiber --- usr.sbin/relayd/relay_http.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/usr.sbin/relayd/relay_http.c b/usr.sbin/relayd/relay_http.c index bd71353980e..d6960e83eb7 100644 --- a/usr.sbin/relayd/relay_http.c +++ b/usr.sbin/relayd/relay_http.c @@ -1,4 +1,4 @@ -/* $OpenBSD: relay_http.c,v 1.95 2026/04/02 13:28:22 tb Exp $ */ +/* $OpenBSD: relay_http.c,v 1.96 2026/04/02 13:35:36 tb Exp $ */ /* * Copyright (c) 2006 - 2016 Reyk Floeter @@ -1388,11 +1388,12 @@ relay_httperror_byid(u_int id) /* Set up key */ error.error_code = (int)id; - res = bsearch(&error, http_errors, + if ((res = bsearch(&error, http_errors, sizeof(http_errors) / sizeof(http_errors[0]) - 1, - sizeof(http_errors[0]), relay_httperror_cmp); + sizeof(http_errors[0]), relay_httperror_cmp)) != NULL) + return (res->error_name); - return (res->error_name); + return (NULL); } static int