mirrors/haproxy
1
0
Fork 0
mirror of https://git.haproxy.org/git/haproxy.git/ synced 2026-02-13 05:11:17 +01:00
Code Issues Projects Releases Wiki Activity

BUG/MINOR: startup: fix UAF when set the default for log_tag

Browse Source 
In the init_early() global.log_tag is initialized to the string from progname
pointer and global.log_tag.area points to this pointer.

If log-tag keyword is provided in the configuration, its parser at first frees
global.log_tag.area and then it does a new memory allocation to copy
there the argument of log-tag. So, progname no longer points to the valid
memory.

To fix this, let's always keep progname and global.log_tag.area at separate
memory areas. If log_tag will be redefined in the configuration, its parser will
free the memory allocated for the default value in chunk_destroy(). Memory
allocated for progname will be freed in deinit().

This should not be backported as related to the latest master-worker
refactoring.
This commit is contained in:
Valentine Krasnobaeva 2024-11-21 16:21:54 +01:00 committed by Willy Tarreau
parent d1c3cd8974
commit 351ae5dbed
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
src/haproxy.c
View File

@ -1592,7 +1592,7 @@ static void init_early(int argc, char **argv)
exit(EXIT_FAILURE);
}
chunk_initlen(&global.log_tag, progname, len, len);
chunk_initlen(&global.log_tag, strdup(progname), len, len);
}
/* handles program arguments. Very minimal parsing is performed, variables are