mirrors/haproxy
1
0
Fork 0
mirror of https://git.haproxy.org/git/haproxy.git/ synced 2025-12-07 10:40:59 +01:00
Code Issues Projects Releases Wiki Activity

BUG/MINOR: server: fix srv_drop() crash on partially init srv

Browse Source 
A recent patch has introduced free operation for QUIC tokens stored in a
server. These values are located in <per_thr> server array.

However, a server instance may be released prior to its full
initialization in case of a failure during "add server" CLI command. The
mentionned patch would cause a srv_drop() crash due to an invalid usage
of NULL <per_thr> member.

Fix this by adding a check on <per_thr> prior to dereference it in
srv_drop().

No need to backport.
This commit is contained in:
Amaury Denoyelle 2025-11-25 15:07:51 +01:00
parent 6c08eb7173
commit a363b536a9
1 changed files with 4 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
src/server.c
View File

@ -3241,8 +3241,10 @@ struct server *srv_drop(struct server *srv)
free(srv->id);
#ifdef USE_QUIC
for (i = 0; i < global.nbthread; i++)
istfree(&srv->per_thr[i].quic_retry_token);
if (srv->per_thr) {
for (i = 0; i < global.nbthread; i++)
istfree(&srv->per_thr[i].quic_retry_token);
}
#endif
srv_free_params(srv);