RepoMirrors
/
haproxy
mirror of http://git.haproxy.org/git/haproxy.git/
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

BUG/MEDIUM: pattern: Renew the pattern expression revision when it is pruned 

It must be done to expire patterns cached in the LRU cache. Otherwise it is
possible to retrieve an already freed pattern, attached to a released pattern
expression.

When a specific pattern is deleted (->delete() callback), the pattern expression
revision is already renewed. Thus it is not affected by this bug. Only prune
action on the pattern expression is concerned.

In addition, for a pattern expression, in ->prune() callbacks when the pattern
list is released, a missing LIST_DEL() has been added. It is not a real issue
because the list is reinitialized at the end and all elements are released and
should never be reused. But it is less confusing this way.

This bug may be triggered when a map is cleared from the cli socket. A
workaround is to set the pattern cache size (tune.pattern.cache-size) to 0 to
disable it.

This patch should fix the issue #844. It must be backported to all supported
versions.
This commit is contained in:
Christopher Faulet 2020-09-09 16:09:44 +02:00
parent fc85494c99
commit 6cfc851674
1 changed files with 6 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
src/pattern.c
View File

@ -1093,6 +1093,7 @@ void pat_prune_val(struct pattern_expr *expr)
struct pattern_list *pat, *tmp;
list_for_each_entry_safe(pat, tmp, &expr->patterns, list) {
LIST_DEL(&pat->list);
free(pat->pat.data);
free(pat);
}
@ -1100,6 +1101,7 @@ void pat_prune_val(struct pattern_expr *expr)
free_pattern_tree(&expr->pattern_tree);
free_pattern_tree(&expr->pattern_tree_2);
LIST_INIT(&expr->patterns);
expr->revision = rdtsc();
}
void pat_prune_ptr(struct pattern_expr *expr)
@ -1107,6 +1109,7 @@ void pat_prune_ptr(struct pattern_expr *expr)
struct pattern_list *pat, *tmp;
list_for_each_entry_safe(pat, tmp, &expr->patterns, list) {
LIST_DEL(&pat->list);
free(pat->pat.ptr.ptr);
free(pat->pat.data);
free(pat);
@ -1115,6 +1118,7 @@ void pat_prune_ptr(struct pattern_expr *expr)
free_pattern_tree(&expr->pattern_tree);
free_pattern_tree(&expr->pattern_tree_2);
LIST_INIT(&expr->patterns);
expr->revision = rdtsc();
}
void pat_prune_reg(struct pattern_expr *expr)
@ -1122,6 +1126,7 @@ void pat_prune_reg(struct pattern_expr *expr)
struct pattern_list *pat, *tmp;
list_for_each_entry_safe(pat, tmp, &expr->patterns, list) {
LIST_DEL(&pat->list);
regex_free(pat->pat.ptr.ptr);
free(pat->pat.data);
free(pat);
@ -1130,6 +1135,7 @@ void pat_prune_reg(struct pattern_expr *expr)
free_pattern_tree(&expr->pattern_tree);
free_pattern_tree(&expr->pattern_tree_2);
LIST_INIT(&expr->patterns);
expr->revision = rdtsc();
}
/*