From: Olivier Houchard <ohouchard@haproxy.com>
Date: Fri, 1 Dec 2017 21:04:05 +0000 (+0100)
Subject: BUG/MEDIUM: checks: Be sure we have a mux if we created a cs.
X-Git-Tag: v1.9-dev1~629
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=6377a0004fa25cc58a0e338a13012d3cf9416ef7;p=thirdparty%2Fhaproxy.git

BUG/MEDIUM: checks: Be sure we have a mux if we created a cs.

In connect_conn_chk(), there were one case we could return with a new
conn_stream created, but no mux attached. With no mux, cs_destroy() would
segfault. Fix that by setting the mux before we can fail.

This should be backported to 1.8.
---

diff --git a/src/checks.c b/src/checks.c
index 63747201e1..eaf84a2257 100644
--- a/src/checks.c
+++ b/src/checks.c
@@ -1564,25 +1564,23 @@ static int connect_conn_chk(struct task *t)
 		conn->addr.to = s->addr;
 	}
 
+	proto = protocol_by_family(conn->addr.to.ss_family);
+
+	conn_prepare(conn, proto, check->xprt);
+	conn_install_mux(conn, &mux_pt_ops, cs);
+	cs_attach(cs, check, &check_conn_cb);
+	conn->target = &s->obj_type;
+
        if ((conn->addr.to.ss_family == AF_INET) || (conn->addr.to.ss_family == AF_INET6)) {
 		int i = 0;
 
 		i = srv_check_healthcheck_port(check);
-		if (i == 0) {
-			cs->data = check;
+		if (i == 0)
 			return SF_ERR_CHK_PORT;
-		}
 
 		set_host_port(&conn->addr.to, i);
 	}
 
-	proto = protocol_by_family(conn->addr.to.ss_family);
-
-	conn_prepare(conn, proto, check->xprt);
-	conn_install_mux(conn, &mux_pt_ops, cs);
-	cs_attach(cs, check, &check_conn_cb);
-	conn->target = &s->obj_type;
-
 	/* no client address */
 	clear_addr(&conn->addr.from);