mirror of
http://git.haproxy.org/git/haproxy.git/
synced 2024-12-17 00:44:33 +00:00
BUG/MAJOR: map: fix a segfault when using http-request set-map
The bug happens with an existing entry, when you try to overwrite the value with wrong data, for example, a string when the type is INT. The code path was not secure and tried to set *err and *merr while err = merr = NULL when performing an http action. Must be backported in 1.6, 1.7, 1.8.
This commit is contained in:
parent
6e1796e85d
commit
579fb25b62
@ -1815,12 +1815,14 @@ int pat_ref_set(struct pat_ref *ref, const char *key, const char *value, char **
|
||||
list_for_each_entry(elt, &ref->head, list) {
|
||||
if (strcmp(key, elt->pattern) == 0) {
|
||||
if (!pat_ref_set_elt(ref, elt, value, merr)) {
|
||||
if (!found)
|
||||
*err = *merr;
|
||||
else {
|
||||
memprintf(err, "%s, %s", *err, *merr);
|
||||
free(*merr);
|
||||
*merr = NULL;
|
||||
if (err && merr) {
|
||||
if (!found) {
|
||||
*err = *merr;
|
||||
} else {
|
||||
memprintf(err, "%s, %s", *err, *merr);
|
||||
free(*merr);
|
||||
*merr = NULL;
|
||||
}
|
||||
}
|
||||
}
|
||||
found = 1;
|
||||
|
Loading…
Reference in New Issue
Block a user