mirrors/haproxy
1
0
Fork 0
mirror of https://git.haproxy.org/git/haproxy.git/ synced 2026-02-11 20:31:11 +01:00
Code Issues Projects Releases Wiki Activity

BUG/MINOR: listener: fix potential null pointer dereference in listener_release()

Browse Source 
As reported by @Bbulatov on GH #2804, fe is found at multiple places in
listener_release(): in some places it is first checked against NULL before
being de-referenced while in some other places it is not, which is
ambiguous and could hide a bug.

In practise, fe cannot be NULL for now, but it might not be the case in
the future as we want to keep the possibility to run isolated listeners
(that is, without proxy attached).

We've already ensured this was the case with a57786e ("BUG/MINOR:
listener: null pointer dereference suspected by coverity"), but
this promise was recently broken by 65ae134 ("BUG/MINOR: listener: Wake
proxy's mngmt task up if necessary on session release").

Let's fix that by conditionning the block with an "else if" statement
instead of a regular "else".

No need for backport except if multi-connection protocols (ie: FTP) were
to be backported as well.
This commit is contained in:
Aurelien DARRAGON 2024-12-02 16:22:28 +01:00
parent a582b9c18d
commit b167426b6b
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
src/listener.c
View File

@ -1622,7 +1622,7 @@ void listener_release(struct listener *l)
if (fe && !MT_LIST_ISEMPTY(&fe->listener_queue) &&
(!fe->fe_sps_lim || freq_ctr_remain(&fe->fe_counters.sess_per_sec, fe->fe_sps_lim, 0) > 0))
dequeue_proxy_listeners(fe, 0);
else {
else if (fe) {
unsigned int wait;
int expire = TICK_ETERNITY;