From: Christopher Faulet <cfaulet@haproxy.com>
Date: Mon, 14 Nov 2022 07:49:28 +0000 (+0100)
Subject: BUG/MINOR: http-htx: Fix error handling during parsing http replies
X-Git-Tag: v2.7-dev9~61
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=5a3d9a77e20a66796357627b1dd807a1b22603a5;p=thirdparty%2Fhaproxy.git

BUG/MINOR: http-htx: Fix error handling during parsing http replies

When an error is triggered during arguments parsing of an http reply (for
instance, from a "return" rule), while a log-format body was expected but
not evaluated yet, HAproxy crashes when the body log-format string is
released because it was not properly initialized.

The list used for the log-format string must be initialized earlier.

This patch should fix the issue #1925. It must be backported as far as 2.2.
---

diff --git a/src/http_htx.c b/src/http_htx.c
index 9b7ef6fcb0..7a32c2156f 100644
--- a/src/http_htx.c
+++ b/src/http_htx.c
@@ -1571,6 +1571,7 @@ struct http_reply *http_parse_http_reply(const char **args, int *orig_arg, struc
 			fd = -1;
 			obj[objlen] = '\0';
 			reply->type = HTTP_REPLY_LOGFMT;
+			LIST_INIT(&reply->body.fmt);
 			cur_arg++;
 		}
 		else if (strcmp(args[cur_arg], "lf-string") == 0) {
@@ -1587,6 +1588,7 @@ struct http_reply *http_parse_http_reply(const char **args, int *orig_arg, struc
 			obj = strdup(args[cur_arg]);
 			objlen = strlen(args[cur_arg]);
 			reply->type = HTTP_REPLY_LOGFMT;
+			LIST_INIT(&reply->body.fmt);
 			cur_arg++;
 		}
 		else if (strcmp(args[cur_arg], "hdr") == 0) {