From: Eric Salama <esalama@haproxy.com>
Date: Tue, 23 Feb 2021 15:50:57 +0000 (+0100)
Subject: BUG/MINOR: ssl: potential null pointer dereference in ckchs_dup()
X-Git-Tag: v2.4-dev10~17
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=6ac61e39c491f6ca5a1843c787da2e92818ee02a;p=thirdparty%2Fhaproxy.git

BUG/MINOR: ssl: potential null pointer dereference in ckchs_dup()

A potential null pointer dereference was reported with an old gcc
version (6.5)

    src/ssl_ckch.c: In function 'cli_parse_set_cert':
    src/ssl_ckch.c:844:7: error: potential null pointer dereference [-Werror=null-dereference]
      if (!ssl_sock_copy_cert_key_and_chain(src->ckch, dst->ckch))
	   ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    src/ssl_ckch.c:844:7: error: potential null pointer dereference [-Werror=null-dereference]
    src/ssl_ckch.c: In function 'ckchs_dup':
    src/ssl_ckch.c:844:7: error: potential null pointer dereference [-Werror=null-dereference]
      if (!ssl_sock_copy_cert_key_and_chain(src->ckch, dst->ckch))
	   ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    src/ssl_ckch.c:844:7: error: potential null pointer dereference [-Werror=null-dereference]

This could happen if ckch_store_new() fails to allocate memory and returns NULL.

This patch must be backported with 8f71298 since it was wrongly fixed and
the bug could happen.

Must be backported as far as 2.2.
---

diff --git a/src/ssl_ckch.c b/src/ssl_ckch.c
index 174ab0a96c..c206a09c65 100644
--- a/src/ssl_ckch.c
+++ b/src/ssl_ckch.c
@@ -840,6 +840,8 @@ struct ckch_store *ckchs_dup(const struct ckch_store *src)
 		return NULL;
 
 	dst = ckch_store_new(src->path);
+	if (!dst)
+		return NULL;
 
 	if (!ssl_sock_copy_cert_key_and_chain(src->ckch, dst->ckch))
 		goto error;