]> git.ipfire.org Git - thirdparty/haproxy.git/commit
BUG/MINOR: ssl: double-free on error path w/ ssl-f-use parser
authorWilliam Lallemand <wlallemand@haproxy.com>
Mon, 16 Feb 2026 14:22:47 +0000 (15:22 +0100)
committerWilliam Lallemand <wlallemand@haproxy.com>
Mon, 16 Feb 2026 15:04:35 +0000 (16:04 +0100)
commit86df0e206e94ebfc2a87bf60ec74e86cc0235ffa
tree0ce043a4f03af833e2c29286ca49f784c473cbfe
parentdf8e05815c4689c52451f4ec2074b7dae808b780
BUG/MINOR: ssl: double-free on error path w/ ssl-f-use parser

In post_section_frontend_crt_init(), the crt_entry is populated by the
ssl_conf fromt the cfg_crt_node. On error path, the crt_list is
completely freed, including the ssl_conf structure. But the ssl_conf
structure was already freed when freeing the cfg_crt_node.

Fix the issue by doing a crtlist_dup_ssl_conf(n->ssl_conf) in the
crtlist_entry instead of an assignation.

Fix issue #3268.

Need to be backported as far as 3.2. The previous patch which adds the
crtlist_dup_ssl_conf() declaration is needed.
src/cfgparse-ssl.c