RepoMirrors/haproxy
1
0
Fork 0
mirror of http://git.haproxy.org/git/haproxy.git/ synced 2025-04-01 22:48:25 +00:00
Code Issues Packages Projects Releases Wiki Activity

BUG/MEDIUM: patterns: fix possible double free when reloading a pattern list

Browse Source 
A null pointer assignment was missing after free() in function
pat_ref_reload() which can lead to segfault.

This bug was introduced in commit b5997f7 ("MAJOR: threads/map: Make
acls/maps thread safe").

Must be backported to 1.8.
This commit is contained in:
Dragan Dosen 2018-09-18 20:18:09 +02:00 committed by Willy Tarreau
parent 73373ab43a
commit f147479bd5
1 changed files with 3 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
src/pattern.c
View File

@ -2067,10 +2067,8 @@ int pat_ref_add(struct pat_ref *ref,
void pat_ref_reload(struct pat_ref *ref, struct pat_ref *replace) void pat_ref_reload(struct pat_ref *ref, struct pat_ref *replace)
{ {
struct pattern_expr *expr; struct pattern_expr *expr;
char *err = NULL;
struct pat_ref_elt *elt, *safe; struct pat_ref_elt *elt, *safe;
struct bref *bref, *back; struct bref *bref, *back;
struct sample_data *data;
struct pattern pattern; struct pattern pattern;
@ -2105,6 +2103,9 @@ void pat_ref_reload(struct pat_ref *ref, struct pat_ref *replace)
list_for_each_entry(expr, &ref->pat, list) { list_for_each_entry(expr, &ref->pat, list) {
expr->pat_head->prune(expr); expr->pat_head->prune(expr);
list_for_each_entry(elt, &ref->head, list) { list_for_each_entry(elt, &ref->head, list) {
char *err = NULL;
struct sample_data *data = NULL;
/* Create sample */ /* Create sample */
if (elt->sample && expr->pat_head->parse_smp) { if (elt->sample && expr->pat_head->parse_smp) {
/* New sample. */ /* New sample. */
@ -2122,8 +2123,6 @@ void pat_ref_reload(struct pat_ref *ref, struct pat_ref *replace)
} }
} }
else
data = NULL;
/* initialise pattern */ /* initialise pattern */
memset(&pattern, 0, sizeof(pattern)); memset(&pattern, 0, sizeof(pattern));