BUG/MINOR: resolvers: fix dangling list pointer in resolvers_new() error paths

The resolver 'r' is appended to the global sec_resolvers list, but upon failure
later, pointers are released but the element remains in the list, corrupting it,
and possibly causing a crash during deinit() when releasing remaining ones.
Adding a LIST_DEL_INIT() on the error unrolling path is sufficient.

Note that the issue will only happen on failure to allocate memory via
strdup() so the risk is low. The bug was introduced in 2.6 by commit
e7f5776800 ("MINOR: resolvers: resolvers_new() create a resolvers with
default values"), so the fix may be backported to several releases, but
does not necessarily have to go that far.
This commit is contained in:
Willy Tarreau 2026-05-14 22:59:58 +00:00
parent 8aa99dfc74
commit 493dc352ad

View file

@ -3669,6 +3669,7 @@ err_free_conf_file:
ha_free((void **)&r->conf.file);
err_free_p:
proxy_drop(p);
LIST_DEL_INIT(&r->list);
err_free_r:
ha_free(&r);
return err_code;