]> git.ipfire.org Git - thirdparty/haproxy.git/commit
BUG/MINOR: ssl: revert two wrong fixes with ckhi_link
authorWilliam Lallemand <wlallemand@haproxy.org>
Tue, 30 Aug 2022 15:32:38 +0000 (17:32 +0200)
committerWilliam Lallemand <wlallemand@haproxy.org>
Tue, 30 Aug 2022 16:12:28 +0000 (18:12 +0200)
commit0bfa3e7ff28942b374a937f5d307b1007b076545
tree7436f62ca6ed7c4582f73fe59f688ef4122818c6
parentddd480cbdc0d54b3426ce9b6dd68cd849747cb07
BUG/MINOR: ssl: revert two wrong fixes with ckhi_link

This reverts commit 056ad01d55675ab2d65c7b41a2e1096db27b3d14.
This reverts commit ddd480cbdc0d54b3426ce9b6dd68cd849747cb07.

The architecture is ambiguous here: ckch_inst_free() is detaching and
freeing the "ckch_inst_link" linked list which must be free'd only from
the cafile_entry side.

The problem was also hidden by the fix ddd480c ("BUG/MEDIUM: ssl: Fix a
UAF when old ckch instances are released") which change the ckchi_link
inner loop by a safe one. However this can't fix entirely the problem
since both __ckch_inst_free_locked() could remove several nodes in the
ckchi_link linked list.

This revert is voluntary reintroducing a memory leak before really fixing
the problem.

Must be backported in 2.5 + 2.6.
src/ssl_ckch.c