upstream/haproxy
1
0
Fork 0
mirror of https://github.com/haproxy/haproxy.git synced 2026-03-23 10:53:04 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions 8

BUG/MINOR: guid: fix crash on invalid guid name

Browse source 
Using an invalid GUID for guid_insert() causes a crash. This is easily
reproducible using for example an invalid character with "guid" keyword.
Here is the provided backtrace :

  Thread 1 "haproxy" received signal SIGSEGV, Segmentation fault.
  0x00005555561fda95 in guid_insert (objt=0x520000002080, uid=0x519000002dac "@foo2", errmsg=0x7ffff4c0a7a0)
      at src/guid.c:83
  83              ha_free(&guid->node.key);

This error is present in guid_insert() cleanup parts. GUID node is not
allocated in case of an early error so it's impossible to dereference it
to free guid.node.key. Fix this simply by using an intermediary pointer
key.

This does not need to be backported.
This commit is contained in:
Amaury Denoyelle 2024-04-11 11:05:02 +02:00
parent d78c346670
commit 32b9e97f92
1 changed files with 5 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

9
src/guid.c
View file

@ -28,6 +28,7 @@ int guid_insert(enum obj_type *objt, const char *uid, char **errmsg)
struct guid_node *guid = NULL;
struct guid_node *dup;
struct ebpt_node *node;
char *key = NULL;
char *dup_name = NULL;
const char *c;
@ -61,12 +62,13 @@ int guid_insert(enum obj_type *objt, const char *uid, char **errmsg)
return 0;
}
guid->node.key = strdup(uid);
if (!guid->node.key) {
key = strdup(uid);
if (!key) {
memprintf(errmsg, "key alloc failure");
goto err;
}
guid->node.key = key;
node = ebis_insert(&guid_tree, &guid->node);
if (node != &guid->node) {
dup = ebpt_entry(node, struct guid_node, node);
@ -79,8 +81,7 @@ int guid_insert(enum obj_type *objt, const char *uid, char **errmsg)
return 0;
err:
ALREADY_CHECKED(guid);
ha_free(&guid->node.key);
ha_free(&key);
ha_free(&dup_name);
return 1;
}