From 361935aa1e327d2249453eab0b8f0300683f47b2 Mon Sep 17 00:00:00 2001
From: Christopher Faulet <cfaulet@haproxy.com>
Date: Fri, 13 Sep 2019 09:50:15 +0200
Subject: [PATCH] BUG/MINOR: acl: Fix memory leaks when an ACL expression is
 parsed

This only happens during the configuration parsing. First leak is the string
representing the last converter parsed, if any. The second one is on the error
path, when the allocation of the ACL expression failed. In this case, the sample
was not released.

This patch fixes the issue #256. It must be backported to all stable versions.
---
 src/acl.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/src/acl.c b/src/acl.c
index 318cb5139..209580a11 100644
--- a/src/acl.c
+++ b/src/acl.c
@@ -342,6 +342,8 @@ struct acl_expr *parse_acl_expr(const char **args, char **err, struct arg_list *
 				goto out_free_smp;
 			}
 		}
+		free(ckw);
+		ckw = NULL;
 	}
 	else {
 		/* This is not an ACL keyword, so we hope this is a sample fetch
@@ -360,7 +362,7 @@ struct acl_expr *parse_acl_expr(const char **args, char **err, struct arg_list *
 	expr = calloc(1, sizeof(*expr));
 	if (!expr) {
 		memprintf(err, "out of memory when parsing ACL expression");
-		goto out_return;
+		goto out_free_smp;
 	}
 
 	pattern_init_head(&expr->pat);
@@ -678,8 +680,8 @@ struct acl_expr *parse_acl_expr(const char **args, char **err, struct arg_list *
  out_free_expr:
 	prune_acl_expr(expr);
 	free(expr);
-	free(ckw);
  out_free_smp:
+	free(ckw);
 	free(smp);
  out_return:
 	return NULL;