From d988f21589b1fd215bba4f72a11d656d5d50b77c Mon Sep 17 00:00:00 2001 From: Thierry FOURNIER Date: Tue, 15 Apr 2014 01:15:52 +0200 Subject: [PATCH] BUG/MAJOR: session: fix a possible crash with src_tracked Since commit 4d4149c ("MEDIUM: counters: support passing the counter number as a fetch argument"), the sample fetch sc_tracked(num) became equivalent to sc[0-9]_tracked, by using the same smp_fetch_sc_tracked() function. This was theorically made possible after the series of changes starting with commit a65536ca ("MINOR: counters: provide a generic function to retrieve a stkctr for sc* and src."). Unfortunately, while all other functions were changed to use the generic primitive smp_fetch_sc_stkctr(), smp_fetch_sc_tracked() was forgotten and is not able to differentiate between sc_tracked, src_tracked and sc[0-9]_tracked. The resulting mess is that if sc_tracked is used, the counter number is assumed to be 47 because that's what remains after subtracting "0" from char "_". Fix this by simply relying on the generic function as should have been done. The bug was introduced in 1.5-dev20. No backport is needed. --- src/session.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/session.c b/src/session.c index 99f7558ae8..b85f55471b 100644 --- a/src/session.c +++ b/src/session.c @@ -2692,7 +2692,7 @@ smp_fetch_sc_tracked(struct proxy *px, struct session *l4, void *l7, unsigned in { smp->flags = SMP_F_VOL_TEST; smp->type = SMP_T_BOOL; - smp->data.uint = !!stkctr_entry(&l4->stkctr[kw[2] - '0']); + smp->data.uint = !!smp_fetch_sc_stkctr(l4, args, kw); return 1; } -- 2.47.3