From: William Lallemand <wlallemand@haproxy.com>
Date: Tue, 14 May 2019 09:15:18 +0000 (+0200)
Subject: BUG/MINOR: mworker: use after free when the PID not assigned
X-Git-Tag: v2.0-dev3~16
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=920fc8bbe4240cb36653a1a7f6e459e7668c1643;p=thirdparty%2Fhaproxy.git

BUG/MINOR: mworker: use after free when the PID not assigned

Commit 4528611 ("MEDIUM: mworker: store the leaving state of a process")
introduced a bug in the mworker_env_to_proc_list() function.

This is very unlikely to occur since the PID should always be assigned.
It can probably happen if the environment variable is corrupted.

No backport needed.
---

diff --git a/src/mworker.c b/src/mworker.c
index 8df748d3fa..cac74102cd 100644
--- a/src/mworker.c
+++ b/src/mworker.c
@@ -180,14 +180,15 @@ void mworker_env_to_proc_list()
 			}
 		}
 		if (child->pid) {
+			/* this is a process inherited from a reload that should be leaving */
+			child->options |= PROC_O_LEAVING;
+
 			LIST_ADDQ(&proc_list, &child->list);
 		} else {
 			free(child->id);
 			free(child);
 
 		}
-		/* this is a process inherited from a reload that should be leaving */
-		child->options |= PROC_O_LEAVING;
 	}
 
 	unsetenv("HAPROXY_PROCESSES");