upstream/haproxy
1
0
Fork 0
mirror of https://github.com/haproxy/haproxy.git synced 2026-04-20 22:01:49 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions 12

BUG/MEDIUM: sink: invalid server list in sink_new_from_logsrv()

Browse source 
forward proxy server list created from sink_new_from_logsrv() is invalid

Indeed, srv->next is literally assigned to itself. This did not cause
issues during syslog handling because the sft was properly set, but it
will cause the free_proxy(sink->forward_px) at deinit to go wild since
free_proxy() will try to iterate through the proxy srv list to free
ressources, but because of the improper list initialization, double-free
and infinite-loop will occur.

This bug was revealed by 9b1d15f53a ("BUG/MINOR: sink: free forward_px on deinit()")

It must be backported as far as 2.4.
This commit is contained in:
Aurelien DARRAGON 2023-07-06 14:57:32 +02:00 committed by Christopher Faulet
parent ca4fd73938
commit 999699a277
1 changed files with 1 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
src/sink.c
View file

@ -1089,8 +1089,8 @@ struct sink *sink_new_from_logsrv(struct logsrv *logsrv)
/* the servers are linked backwards
* first into proxy
*/
p->srv = srv;
srv->next = p->srv;
p->srv = srv;
/* allocate sink_forward_target descriptor */
sft = calloc(1, sizeof(*sft));