From: Thierry FOURNIER <tfournier@exceliance.fr>
Date: Wed, 15 Jan 2014 17:09:36 +0000 (+0100)
Subject: BUG/MEDIUM: map: segmentation fault with the stats's socket command "set map ..."
X-Git-Tag: v1.5-dev22~65
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=410f8101ae03f433294f8ac550eaa18e824422cd;p=thirdparty%2Fhaproxy.git

BUG/MEDIUM: map: segmentation fault with the stats's socket command "set map ..."

The value of the variable "appctx->ctx.map.ent" is used after the loop,
but its value has changed. The variable "value" is initialized and
contains the good value.

This is a recent bug, no backport is needed.
---

diff --git a/src/dumpstats.c b/src/dumpstats.c
index e313b5a96a..219b81fd71 100644
--- a/src/dumpstats.c
+++ b/src/dumpstats.c
@@ -1455,7 +1455,7 @@ static int stats_sock_parse_request(struct stream_interface *si, char *line)
 		else if (strcmp(args[1], "map") == 0) {
 			struct pattern *pat_elt;
 			struct pat_idx_elt *idx_elt;
-			char *value;
+			char *value = NULL;
 
 			/* Expect three parameters: map name, key and new value. */
 			if (!*args[2] || !*args[3] || !*args[4]) {
@@ -1506,9 +1506,9 @@ static int stats_sock_parse_request(struct stream_interface *si, char *line)
 			     stats_map_lookup_next(si)) {
 				pattern_lookup(args[3], appctx->ctx.map.desc->pat, &pat_elt, &idx_elt, NULL);
 				if (pat_elt != NULL)
-					appctx->ctx.map.desc->parse(appctx->ctx.map.ent->value, pat_elt->smp);
+					appctx->ctx.map.desc->parse(value, pat_elt->smp);
 				if (idx_elt != NULL)
-					appctx->ctx.map.desc->parse(appctx->ctx.map.ent->value, idx_elt->smp);
+					appctx->ctx.map.desc->parse(value, idx_elt->smp);
 			}
 
 			/* The set is done, send message. */