1
0
mirror of http://git.haproxy.org/git/haproxy.git/ synced 2024-12-17 00:44:33 +00:00

BUG/MAJOR: map: fix a segfault when using http-request set-map

The bug happens with an existing entry, when you try to overwrite the
value with wrong data, for example, a string when the type is INT.

The code path was not secure and tried to set *err and *merr while
err = merr = NULL when performing an http action.

Must be backported in 1.6, 1.7, 1.8.
This commit is contained in:
William Lallemand 2018-06-11 10:53:46 +02:00 committed by Willy Tarreau
parent 6e1796e85d
commit 579fb25b62

View File

@ -1815,12 +1815,14 @@ int pat_ref_set(struct pat_ref *ref, const char *key, const char *value, char **
list_for_each_entry(elt, &ref->head, list) {
if (strcmp(key, elt->pattern) == 0) {
if (!pat_ref_set_elt(ref, elt, value, merr)) {
if (!found)
*err = *merr;
else {
memprintf(err, "%s, %s", *err, *merr);
free(*merr);
*merr = NULL;
if (err && merr) {
if (!found) {
*err = *merr;
} else {
memprintf(err, "%s, %s", *err, *merr);
free(*merr);
*merr = NULL;
}
}
}
found = 1;