From: Thierry FOURNIER <tfournier@arpalert.org>
Date: Mon, 17 Aug 2015 16:38:24 +0000 (+0200)
Subject: BUG/MEDIUM: vars: segfault during the configuration parsing
X-Git-Tag: v1.6-dev4~67
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=6f82b6dc353a038e007e6a580221882bb67c2160;p=thirdparty%2Fhaproxy.git

BUG/MEDIUM: vars: segfault during the configuration parsing

This bug is introduced by the patch 48a9cd104d07919fdd941b36e9f927a20d55edd3
"MINOR: vars: reduce the code size of some wrappers". A dereferencement was
removed.
---

diff --git a/src/vars.c b/src/vars.c
index 8cd09a61a0..adacd2f949 100644
--- a/src/vars.c
+++ b/src/vars.c
@@ -607,9 +607,9 @@ static int parse_tcp_req_store(const char **args, int *arg, struct proxy *px,
                                struct tcp_rule *rule, char **err)
 {
 	if (!parse_vars(args, arg, px, SMP_VAL_FE_REQ_CNT, err,
-                   (struct sample_expr **)rule->act_prm.data[0],
-                   (char **)rule->act_prm.data[1],
-                   (enum vars_scope *)rule->act_prm.data[2]))
+                   (struct sample_expr **)&rule->act_prm.data[0],
+                   (char **)&rule->act_prm.data[1],
+                   (enum vars_scope *)&rule->act_prm.data[2]))
 		return 0;
 	rule->action       = TCP_ACT_CUSTOM_CONT;
 	rule->action_ptr   = action_tcp_req_store;
@@ -621,9 +621,9 @@ static int parse_tcp_res_store(const char **args, int *arg, struct proxy *px,
                          struct tcp_rule *rule, char **err)
 {
 	if (!parse_vars(args, arg, px, SMP_VAL_BE_RES_CNT, err,
-                   (struct sample_expr **)rule->act_prm.data[0],
-                   (char **)rule->act_prm.data[1],
-                   (enum vars_scope *)rule->act_prm.data[2]))
+                   (struct sample_expr **)&rule->act_prm.data[0],
+                   (char **)&rule->act_prm.data[1],
+                   (enum vars_scope *)&rule->act_prm.data[2]))
 		return 0;
 	rule->action       = TCP_ACT_CUSTOM_CONT;
 	rule->action_ptr   = action_tcp_res_store;
@@ -635,9 +635,9 @@ static int parse_http_req_store(const char **args, int *arg, struct proxy *px,
                          struct http_req_rule *rule, char **err)
 {
 	if (!parse_vars(args, arg, px, SMP_VAL_FE_HRQ_HDR, err,
-                   (struct sample_expr **)rule->arg.act.p[0],
-                   (char **)rule->arg.act.p[1],
-                   (enum vars_scope *)rule->arg.act.p[2]))
+                   (struct sample_expr **)&rule->arg.act.p[0],
+                   (char **)&rule->arg.act.p[1],
+                   (enum vars_scope *)&rule->arg.act.p[2]))
 		return -1;
 	rule->action       = HTTP_REQ_ACT_CUSTOM_CONT;
 	rule->action_ptr   = action_http_req_store;
@@ -649,9 +649,9 @@ static int parse_http_res_store(const char **args, int *arg, struct proxy *px,
                          struct http_res_rule *rule, char **err)
 {
 	if (!parse_vars(args, arg, px, SMP_VAL_BE_HRS_HDR, err,
-                   (struct sample_expr **)rule->arg.act.p[0],
-                   (char **)rule->arg.act.p[1],
-                   (enum vars_scope *)rule->arg.act.p[2]))
+                   (struct sample_expr **)&rule->arg.act.p[0],
+                   (char **)&rule->arg.act.p[1],
+                   (enum vars_scope *)&rule->arg.act.p[2]))
 		return -1;
 	rule->action       = HTTP_RES_ACT_CUSTOM_CONT;
 	rule->action_ptr   = action_http_res_store;