On Mon, Aug 31, 2026 at 12:01:47PM +0200, Denis V. Lunev wrote: > From: Denis V. Lunev <[email protected]> > > qio_channel_websock_extract_headers() returns 0 without queueing a > response when the request line contains no space, unlike every sibling > check which jumps to bad_request. encoutput stays empty, yet > qio_channel_websock_handshake_read() still reports success and the > caller arms a G_IO_OUT watch to flush nothing. > > Flushing that empty buffer is where QEMU crashes. Any client can > trigger it before authentication on a VNC websocket port: > > printf 'stats\r\nx\r\n\r\n' | nc $host $port > > Fixes: 07e95cd529af ("io: fully parse & validate HTTP headers for websocket > protocol handshake")
"bad_request" was introduced in f69a8bde29354493ff8aea64cc9cb3b531d16337 which intended to fix 07e95cd529af, but missed that one return statement. So I'd suggest "Fixes: f69a8bde29", or even both commits. > Cc: [email protected] > Cc: Daniel P. Berrangé <[email protected]> > Cc: Marc-André Lureau <[email protected]> > Signed-off-by: Denis V. Lunev <[email protected]> > --- > io/channel-websock.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) Reviewed-by: Daniel P. Berrangé <[email protected]> > > diff --git a/io/channel-websock.c b/io/channel-websock.c > index 1929abf56a..66c91ed2a2 100644 > --- a/io/channel-websock.c > +++ b/io/channel-websock.c > @@ -230,7 +230,7 @@ qio_channel_websock_extract_headers(QIOChannelWebsock > *ioc, > tmp = strchr(buffer, ' '); > if (!tmp) { > error_setg(errp, "Missing HTTP path delimiter"); > - return 0; > + goto bad_request; > } > *tmp = '\0'; > > -- > 2.53.0 > With regards, Daniel -- |: https://berrange.com ~~ https://hachyderm.io/@berrange :| |: https://libvirt.org ~~ https://entangle-photo.org :| |: https://pixelfed.art/berrange ~~ https://fstop138.berrange.com :|
