]> git.ipfire.org Git - thirdparty/haproxy.git/commit
BUG/MINOR: quic: fix qc.cids access on quic-conn fail alloc
authorAmaury Denoyelle <adenoyelle@haproxy.com>
Wed, 11 Oct 2023 13:40:38 +0000 (15:40 +0200)
committerAmaury Denoyelle <adenoyelle@haproxy.com>
Fri, 13 Oct 2023 06:52:16 +0000 (08:52 +0200)
commit7d76ffb2a49a2926010358a3f3e08a395715a547
tree99f21d6a4b845f8fb71d756a15ad7e243cdc56a4
parent5798b5bb14d2f42002501d7645e41ab15007bc4f
BUG/MINOR: quic: fix qc.cids access on quic-conn fail alloc

CIDs tree is now allocated dynamically since the following commit :
  276697438d50456f92487c990f20c4d726dfdb96
  MINOR: quic: Use a pool for the connection ID tree.

This can caused a crash if qc_new_conn() is interrupted due to an
intermediary failed allocation. When freeing all connection members,
free_quic_conn_cids() is used. However, this function does not support a
NULL cids.

To fix this, simply check that cids is NULL during free_quic_conn_cids()
prologue.

This bug was reproduced using -dMfail.

No need to backport.
include/haproxy/quic_conn.h