commit 4c3a9f7f9d06e22d34bebc20a495ec845a46b824
from: tb <tb@openbsd.org>
date: Thu Apr  2 13:35:36 2026 UTC

relayd: error check bsearch in relay_httperror_byid()

If relay_httperror_byid() is passed a HTTP error code not in the table
this would result in a NULL deref. The intent is that the code fall back
to "Unknown error" on NULL return.

From Jan Schreiber

commit - 7ef192f50c90fdf6076af21336101fafcccfe678
commit + 4c3a9f7f9d06e22d34bebc20a495ec845a46b824
blob - bd71353980ece9207e186ba5e1444a760aa80986
blob + d6960e83eb7a11678a5e4211687e018a2e127c2c
--- relay_http.c
+++ relay_http.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: relay_http.c,v 1.95 2026/04/02 13:28:22 tb Exp $	*/
+/*	$OpenBSD: relay_http.c,v 1.96 2026/04/02 13:35:36 tb Exp $	*/
 
 /*
  * Copyright (c) 2006 - 2016 Reyk Floeter <reyk@openbsd.org>
@@ -1388,11 +1388,12 @@ relay_httperror_byid(u_int id)
 	/* Set up key */
 	error.error_code = (int)id;
 
-	res = bsearch(&error, http_errors,
+	if ((res = bsearch(&error, http_errors,
 	    sizeof(http_errors) / sizeof(http_errors[0]) - 1,
-	    sizeof(http_errors[0]), relay_httperror_cmp);
+	    sizeof(http_errors[0]), relay_httperror_cmp)) != NULL)
+		return (res->error_name);
 
-	return (res->error_name);
+	return (NULL);
 }
 
 static int