From: Willy Tarreau <w@1wt.eu>
Date: Mon, 18 Nov 2013 17:04:25 +0000 (+0100)
Subject: BUG/MEDIUM: http: fix possible parser crash when parsing erroneous "http-request... 
X-Git-Tag: v1.5-dev20~237
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=6d4890cfeaeac2983406ad544fde64400a1361a0;p=thirdparty%2Fhaproxy.git

BUG/MEDIUM: http: fix possible parser crash when parsing erroneous "http-request redirect" rules

Baptiste Assmann reported a bug affecting the "http-request redirect"
parser. It may randomly crash when reporting an error message if the
syntax is not OK. It happens that this is caused by the output error
message pointer which was not initialized to NULL.

This bug is 1.5-specific (introduced in dev17), no backport is needed.
---

diff --git a/src/proto_http.c b/src/proto_http.c
index e82516734a..f037b1edd0 100644
--- a/src/proto_http.c
+++ b/src/proto_http.c
@@ -8491,7 +8491,7 @@ struct http_req_rule *parse_http_req_cond(const char **args, const char *file, i
 		cur_arg += 2;
 	} else if (strcmp(args[0], "redirect") == 0) {
 		struct redirect_rule *redir;
-		char *errmsg;
+		char *errmsg = NULL;
 
 		if ((redir = http_parse_redirect_rule(file, linenum, proxy, (const char **)args + 1, &errmsg)) == NULL) {
 			Alert("parsing [%s:%d] : error detected in %s '%s' while parsing 'http-request %s' rule : %s.\n",