file: respond 500 on uh_handle_alias OOM

realloc(new_url, new_len) returning NULL was overwriting new_url with
NULL and then dereferencing it via *new_url = '\0' for an immediate
segfault on out-of-memory.

Keep the previous allocation by going through a tmp pointer, return
NULL from uh_handle_alias on failure, and have the caller surface a
proper 500 Internal Server Error to the client instead of silently
dispatching the un-rewritten URL through static-file lookup -- which
in some configurations could route to a different resource than the
alias intended.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>

1 files changed, 8 insertions, 1 deletions

diff --git a/file.c b/file.c
index dd0f881..c29ec42 100644
--- a/file.c
+++ b/file.c
@@ -912,7 +912,10 @@ static char *uh_handle_alias(char *old_url)
 		new_len = old_len + MAX(conf.cgi_prefix_len, path_len);
 
 		if (new_len > url_len) {
-			new_url = realloc(new_url, new_len);
+			char *tmp = realloc(new_url, new_len);
+			if (!tmp)
+				return NULL;
+			new_url = tmp;
 			url_len = new_len;
 		}
 
@@ -938,6 +941,10 @@ void uh_handle_request(struct client *cl)
 
 	blob_buf_init(&cl->hdr_response, 0);
 	url = uh_handle_alias(url);
+	if (!url) {
+		uh_client_error(cl, 500, "Internal Server Error", "Out of memory");
+		return;
+	}
 
 	uh_handler_run(cl, &url, false);
 	if (!url)