RepoMirrors
/
haproxy
mirror of http://git.haproxy.org/git/haproxy.git/
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

MINOR: stick-tables: make stktable_release() do nothing on NULL 

stktable_release() has been involved in two recent crashes by being
used without enough care. Just like any free() function this one is
often called on an exit path with a possibly unsafe argument. Given
that there is another case (smp_fetch_sc_trackers()) which theorically
could call it with an unchecked NULL, though it cannot happen since
the function doesn't support being called with src_* hence cannot make
use of tmpstkctr, let's rather move the check into the function itself
to make it safer for the long term.

This patch could be backported to 1.8 as a strengthening measure.
This commit is contained in:
Willy Tarreau 2018-06-27 06:25:57 +02:00
parent 65189c17c6
commit 43e903553e
1 changed files with 6 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
src/stick_table.c
View File

@ -412,9 +412,11 @@ void stktable_touch_local(struct stktable *t, struct stksess *ts, int decrefcnt)
ts->ref_cnt--;
HA_SPIN_UNLOCK(STK_TABLE_LOCK, &t->lock);
}
/* Just decrease the ref_cnt of the current session */
void stktable_release(struct stktable *t, struct stksess *ts)
/* Just decrease the ref_cnt of the current session. Does nothing if <ts> is NULL */
static void stktable_release(struct stktable *t, struct stksess *ts)
{
if (!ts)
return;
HA_SPIN_LOCK(STK_TABLE_LOCK, &t->lock);
ts->ref_cnt--;
HA_SPIN_UNLOCK(STK_TABLE_LOCK, &t->lock);
@ -875,8 +877,7 @@ static int sample_conv_in_table(const struct arg *arg_p, struct sample *smp, voi
smp->data.type = SMP_T_BOOL;
smp->data.u.sint = !!ts;
smp->flags = SMP_F_VOL_TEST;
if (ts)
stktable_release(t, ts);
stktable_release(t, ts);
return 1;
}
@ -2014,7 +2015,7 @@ smp_fetch_sc_tracked(const struct arg *args, struct sample *smp, const char *kw,
smp->data.u.sint = !!stkctr;
/* release the ref count */
if ((stkctr == &tmpstkctr) && stkctr_entry(stkctr))
if ((stkctr == &tmpstkctr))
stktable_release(stkctr->table, stkctr_entry(stkctr));
return 1;