1berry/haproxy
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

BUG/MINOR: server: remove some incorrect free() calls on null elements

Browse Source 
In commit 6f4bfed3a ("MINOR: server: Add parser support for
set-proxy-v2-tlv-fmt") a few free() calls were made to an element on
error path when it was detected it was NULL. It doesn't have any
effect, however there was one case of use-after-free at the end of
srv_settings_cpy() that was caught by gcc due to attempting to free
the element after freeing its holder.

No backport is needed.
This commit is contained in:
Willy Tarreau 2023-11-04 08:56:01 +01:00
parent e16762f8a8
commit 09eacb8b24
1 changed files with 0 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
src/server.c
View File

@ -1372,7 +1372,6 @@ static int srv_parse_set_proxy_v2_tlv_fmt(char **args, int *cur_arg,
srv_tlv->fmt_string = strdup(args[*cur_arg + 1]);
if (unlikely(!srv_tlv->fmt_string)) {
memprintf(err, "'%s' : failed to save format string for parsing", args[*cur_arg]);
free(srv_tlv->fmt_string);
goto fail;
}
@ -2519,13 +2518,11 @@ void srv_settings_cpy(struct server *srv, const struct server *src, int srv_tmpl
break;
new_srv_tlv = malloc(sizeof(struct srv_pp_tlv_list));
if (unlikely(!new_srv_tlv)) {
free(new_srv_tlv);
break;
}
new_srv_tlv->fmt_string = strdup(srv_tlv->fmt_string);
if (unlikely(!new_srv_tlv->fmt_string)) {
free(new_srv_tlv);
free(new_srv_tlv->fmt_string);
break;
}
new_srv_tlv->type = srv_tlv->type;