]> git.ipfire.org Git - thirdparty/haproxy.git/commitdiff
BUG/MINOR: acme: null pointer dereference upon allocation failure
authorWilliam Lallemand <wlallemand@haproxy.com>
Thu, 11 Sep 2025 11:42:45 +0000 (13:42 +0200)
committerWilliam Lallemand <wlallemand@haproxy.com>
Thu, 11 Sep 2025 12:31:32 +0000 (14:31 +0200)
Reported in issue #3115:

      11. var_compare_op: Comparing task to null implies that task might be null.
681                if (!task) {
682                        ret++;
683                        ha_alert("acme: couldn't start the scheduler!\n");
684                }
CID 1609721: (#1 of 1): Dereference after null check (FORWARD_NULL)
12. var_deref_op: Dereferencing null pointer task.
685                task->nice = 0;
686                task->process = acme_scheduler;
687
688                task_wakeup(task, TASK_WOKEN_INIT);
689        }
690

Task would be dereferenced upon allocation failure instead of falling
back to the end of the function after the error.

Should be backported in 3.2.

src/acme.c

index 06b38b27f55b3da209e76d85d83d3d029ec4b96e..2d8319cdcad758c970224190cce0aca05173139f 100644 (file)
@@ -681,6 +681,7 @@ static int cfg_postparser_acme()
                if (!task) {
                        ret++;
                        ha_alert("acme: couldn't start the scheduler!\n");
+                       goto end;
                }
                task->nice = 0;
                task->process = acme_scheduler;
@@ -688,6 +689,7 @@ static int cfg_postparser_acme()
                task_wakeup(task, TASK_WOKEN_INIT);
        }
 
+end:
        return ret;
 }