From: Willy Tarreau <w@1wt.eu>
Date: Thu, 23 Jun 2022 09:46:14 +0000 (+0200)
Subject: BUG/MINOR: stream: only free the req/res captures when set
X-Git-Tag: v2.7-dev1~8
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=47af31738928214353f635cc44c9df47f6699eac;p=thirdparty%2Fhaproxy.git

BUG/MINOR: stream: only free the req/res captures when set

There's a subtle bug in stream_free() when releasing captures. The
pools may be NULL when no capture is defined, and the calls to
pool_free() are inconditional. The only reason why this doesn't
cause trouble is because the pointer to be freed is always NULL in
this case and we don't go further down the chain. That's particularly
ugly and it complicates debugging, so let's only call these ones when
the pointers are set.

There's no impact on running code, it only fools those trying to debug
pools manually. There's no need to backport it though it unless it helps
for debugging sessions.
---

diff --git a/src/stream.c b/src/stream.c
index 5de7cdda71..7df2cc6076 100644
--- a/src/stream.c
+++ b/src/stream.c
@@ -672,16 +672,15 @@ void stream_free(struct stream *s)
 			struct cap_hdr *h;
 			for (h = fe->req_cap; h; h = h->next)
 				pool_free(h->pool, s->req_cap[h->index]);
+			pool_free(fe->req_cap_pool, s->req_cap);
 		}
 
 		if (s->res_cap) {
 			struct cap_hdr *h;
 			for (h = fe->rsp_cap; h; h = h->next)
 				pool_free(h->pool, s->res_cap[h->index]);
+			pool_free(fe->rsp_cap_pool, s->res_cap);
 		}
-
-		pool_free(fe->rsp_cap_pool, s->res_cap);
-		pool_free(fe->req_cap_pool, s->req_cap);
 	}
 
 	/* Cleanup all variable contexts. */