From: William Lallemand <wlallemand@haproxy.org>
Date: Tue, 21 Feb 2023 12:41:24 +0000 (+0100)
Subject: BUG/MEDIUM: mworker: don't register mworker_accept_wrapper() when master FD is wrong
X-Git-Tag: v2.8-dev5~144
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=cc5b9fa593e139fa330f8c7161ff7514315f2837;p=thirdparty%2Fhaproxy.git

BUG/MEDIUM: mworker: don't register mworker_accept_wrapper() when master FD is wrong

This patch handles the case where the fd could be -1 when proc_self was
lost for some reason (environment variable corrupted or upgrade from < 1.9).

This could result in a out of bound array access fdtab[-1] and would crash.

Must be backported in every maintained versions.
---

diff --git a/src/mworker.c b/src/mworker.c
index e6c8e51b0d..d71bf61564 100644
--- a/src/mworker.c
+++ b/src/mworker.c
@@ -470,6 +470,9 @@ static int mworker_sockpair_register_per_thread()
 	if (tid != 0)
 		return 1;
 
+	if (proc_self->ipc_fd[1] < 0) /* proc_self was incomplete and we can't find the socketpair */
+		return 1;
+
 	fd_set_nonblock(proc_self->ipc_fd[1]);
 	/* register the wrapper to handle read 0 when the master exits */
 	fdtab[proc_self->ipc_fd[1]].iocb = mworker_accept_wrapper;