BUG/MAJOR: servers: Use the list api correctly to avoid crashes.

In connect_server(), if we looked for an usable connection and failed to
find one, srv_conn won't be NULL at the end of list_for_each_entry(), but
will point to the head of a list, which is not a pointer to a struct
connection, so explicitely set it to NULL.

This should be backported to 1.9.

diff --git a/src/backend.c b/src/backend.c
index d52f484cb6e5416195082134b63cd016b7047aaf..e82775058bad4c5dd1b36e1b29f13e83c9f16f58 100644 (file)
--- a/src/backend.c
+++ b/src/backend.c
@@ -1147,7 +1147,8 @@ int connect_server(struct stream *s)
                                }
                        }
                }
-               if (!srv_conn) {
+               if (reuse == 0) {
+                       srv_conn = NULL;
                        for (i = 0; i < MAX_SRV_LIST; i++) {
                                if (!LIST_ISEMPTY(&s->sess->srv_list[i].list)) {
                                        srv_conn = LIST_ELEM(&s->sess->srv_list[i].list,