mirrors/haproxy
1
0
Fork 0
mirror of https://git.haproxy.org/git/haproxy.git/ synced 2025-10-26 14:10:59 +01:00
Code Issues Projects Releases Wiki Activity

BUILD: ssl: can't build when using -DLISTEN_DEFAULT_CIPHERS

Browse Source 
Emeric reported that he can't build haproxy anymore since 9bc6a034
("BUG/MINOR: ssl: Free global_ssl structure contents during deinit").

    src/ssl_sock.c:7020:40: error: comparison with string literal results in unspecified behavior [-Werror=address]
     7020 |  if (global_ssl.listen_default_ciphers != LISTEN_DEFAULT_CIPHERS)
          |                                        ^~
    src/ssl_sock.c:7023:41: error: comparison with string literal results in unspecified behavior [-Werror=address]
     7023 |  if (global_ssl.connect_default_ciphers != CONNECT_DEFAULT_CIPHERS)
          |                                         ^~
    src/ssl_sock.c: At top level:

Indeed the mentionned patch is checking the pointer in order to free
something freeable, but that can't work because these constant are
strings literal which can be passed from the compiler and not pointers.

Also the test is not useful, because these strings are strdup() in
__ssl_sock_init, so they can be free directly.

Must be backported in every stable branches with 9bc6a034.
This commit is contained in:
William Lallemand 2025-10-17 09:35:41 +02:00
parent 5b04a85bc7
commit b74a437e57
1 changed files with 4 additions and 10 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
src/ssl_sock.c
View File

@ -7970,18 +7970,12 @@ static void ssl_free_global(void)
ha_free(&global_ssl.issuers_chain_path);
if (global_ssl.listen_default_ciphers != LISTEN_DEFAULT_CIPHERS)
ha_free(&global_ssl.listen_default_ciphers);
if (global_ssl.connect_default_ciphers != CONNECT_DEFAULT_CIPHERS)
ha_free(&global_ssl.connect_default_ciphers);
ha_free(&global_ssl.listen_default_ciphers);
ha_free(&global_ssl.connect_default_ciphers);
#ifdef HAVE_SSL_CTX_SET_CIPHERSUITES
if (global_ssl.listen_default_ciphersuites != LISTEN_DEFAULT_CIPHERSUITES)
ha_free(&global_ssl.listen_default_ciphersuites);
if (global_ssl.connect_default_ciphersuites != CONNECT_DEFAULT_CIPHERSUITES)
ha_free(&global_ssl.connect_default_ciphersuites);
ha_free(&global_ssl.listen_default_ciphersuites);
ha_free(&global_ssl.connect_default_ciphersuites);
#endif
#if defined(SSL_CTX_set1_curves_list)