Commit cd71c2f40a for qemu.org

commit cd71c2f40a53a569911310aceb21cef55c349d38
Author: Denis V. Lunev <den@openvz.org>
Date:   Mon Aug 31 12:01:47 2026 +0200

    io/channel-websock: send an HTTP 400 when the greeting has no space

    qio_channel_websock_extract_headers() returns 0 without queueing a
    response when the request line contains no space, unlike every sibling
    check which jumps to bad_request. encoutput stays empty, yet
    qio_channel_websock_handshake_read() still reports success and the
    caller arms a G_IO_OUT watch to flush nothing.

    Flushing that empty buffer is where QEMU crashes. Any client can
    trigger it before authentication on a VNC websocket port:

      printf 'stats\r\nx\r\n\r\n' | nc $host $port

    Fixes: 07e95cd529af ("io: fully parse & validate HTTP headers for websocket protocol handshake")
    Fixes: f69a8bde2935 ("io: send proper HTTP response for websocket errors")
    Fixes: CVE-2026-84788
    Cc: qemu-stable@nongnu.org
    Cc: Daniel P. Berrangé <berrange@redhat.com>
    Cc: Marc-André Lureau <marcandre.lureau@redhat.com>
    Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
    Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
    Signed-off-by: Denis V. Lunev <den@openvz.org>
    Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>

diff --git a/io/channel-websock.c b/io/channel-websock.c
index 1929abf56a..66c91ed2a2 100644
--- a/io/channel-websock.c
+++ b/io/channel-websock.c
@@ -230,7 +230,7 @@ qio_channel_websock_extract_headers(QIOChannelWebsock *ioc,
     tmp = strchr(buffer, ' ');
     if (!tmp) {
         error_setg(errp, "Missing HTTP path delimiter");
-        return 0;
+        goto bad_request;
     }
     *tmp = '\0';