upstream/haproxy
1
0
Fork 0
mirror of https://github.com/haproxy/haproxy.git synced 2026-04-25 08:10:54 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions 9

BUG/MINOR: http_htx: fix null deref in http-errors config check

Browse source 
http-errors parsing has been refactored in a recent serie of patches.
However, a null deref was introduced by the following patch in case a
non-existent http-errors section is referenced by an "errorfiles"
directive.

  commit 2ca7601c2d
  MINOR/OPTIM: http_htx: lookup once http_errors section on check/init

Fix this by delaying ha_free() so that it is called after ha_alert().

No need to backport.
This commit is contained in:
Amaury Denoyelle 2026-03-23 13:50:17 +01:00
parent 3d9865a12c
commit 1c379cad88
1 changed files with 2 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

3
src/http_htx.c
View file

@ -2352,15 +2352,16 @@ int proxy_check_http_errors(struct proxy *px)
}
}
ha_free(&conf_err->type.section.name);
if (!section_found) {
ha_alert("proxy '%s': unknown http-errors section '%s' (at %s:%d).\n",
px->id, conf_err->type.section.name, conf_err->file, conf_err->line);
ha_free(&conf_err->type.section.name);
err |= ERR_ALERT | ERR_FATAL;
continue;
}
conf_err->type.section.resolved = http_errs;
ha_free(&conf_err->type.section.name);
for (rc = 0; rc < HTTP_ERR_SIZE; rc++) {
if (conf_err->type.section.status[rc] == HTTP_ERR_IMPORT_EXPLICIT &&