BUG/MAJOR: fix a segfault on option http_proxy and url_ip acl

url2sa() mistakenly uses "addr" as a reference. This causes a segfault when
option http_proxy or url_ip are used.

This bug was introduced in haproxy 1.5 and doesn't need to be backported.

diff --git a/src/standard.c b/src/standard.c
index 287931adf316132e6a5b7f6d9307c5780f048475..76031e95625837a7337b507defcf111a9664dd49 100644 (file)
--- a/src/standard.c
+++ b/src/standard.c
@@ -906,12 +906,12 @@ int url2sa(const char *url, int ulen, struct sockaddr_storage *addr)
                         * be warned this can slow down global daemon performances
                         * while handling lagging dns responses.
                         */
-                       ret = url2ipv4(curr, &((struct sockaddr_in *)&addr)->sin_addr);
+                       ret = url2ipv4(curr, &((struct sockaddr_in *)addr)->sin_addr);
                        if (!ret)
                                return -1;
                        curr += ret;
                        ((struct sockaddr_in *)addr)->sin_port = (*curr == ':') ? str2uic(++curr) : 80;
-                       ((struct sockaddr_in *)addr)->sin_port = htons(((struct sockaddr_in *)&addr)->sin_port);
+                       ((struct sockaddr_in *)addr)->sin_port = htons(((struct sockaddr_in *)addr)->sin_port);
                }
                return 0;
        }