mirror of
https://github.com/haproxy/haproxy.git
synced 2026-02-20 00:10:41 -05:00
3b091f80aa
A small race exists in buffers with "show sess all". This one wants to show some information grabbed from the buffer (especially in HTX mode). But the thread owning this buffer might just be releasing its area, right after a free() or munmap() call, resulting in a head that is not seen as empty yet though the area was released. It may then be dereferenced by "show sess all" causing a crash. Note that in practice it only happens in debug mode with UAF enabled, but it's tricky enough to fix it right now. This should be backported to stable versions which support threads and a store barrier. It's worth noting that by performing the clearing first, b_free() and b_drop() now become two exact equivalent. |
||
|---|---|---|
| .. | ||
| common | ||
| import | ||
| proto | ||
| types | ||