BUG/MEDIUM: map: segmentation fault with the stats's socket command "set map ..."

The value of the variable "appctx->ctx.map.ent" is used after the loop,
but its value has changed. The variable "value" is initialized and
contains the good value.

This is a recent bug, no backport is needed.

diff --git a/src/dumpstats.c b/src/dumpstats.c
index e313b5a96a92daba953931fd3c79816e193bd08b..219b81fd715c2798a7cc01414c7559ecca0a0881 100644 (file)
--- a/src/dumpstats.c
+++ b/src/dumpstats.c
@@ -1455,7 +1455,7 @@ static int stats_sock_parse_request(struct stream_interface *si, char *line)
                else if (strcmp(args[1], "map") == 0) {
                        struct pattern *pat_elt;
                        struct pat_idx_elt *idx_elt;
-                       char *value;
+                       char *value = NULL;
 
                        /* Expect three parameters: map name, key and new value. */
                        if (!*args[2] || !*args[3] || !*args[4]) {
@@ -1506,9 +1506,9 @@ static int stats_sock_parse_request(struct stream_interface *si, char *line)
                             stats_map_lookup_next(si)) {
                                pattern_lookup(args[3], appctx->ctx.map.desc->pat, &pat_elt, &idx_elt, NULL);
                                if (pat_elt != NULL)
-                                       appctx->ctx.map.desc->parse(appctx->ctx.map.ent->value, pat_elt->smp);
+                                       appctx->ctx.map.desc->parse(value, pat_elt->smp);
                                if (idx_elt != NULL)
-                                       appctx->ctx.map.desc->parse(appctx->ctx.map.ent->value, idx_elt->smp);
+                                       appctx->ctx.map.desc->parse(value, idx_elt->smp);
                        }
 
                        /* The set is done, send message. */