BUG/MEDIUM: spoe: clear the applet pointer when the applet fails to start

spoe_create_appctx() assigns the freshly allocated spoe_appctx to
ctx->spoe_appctx before creating and initializing the applet, both of which
may fail. On these error paths the spoe_appctx is released but the pointer
is left in the SPOE context, and the caller reports the failure through
spoe_stop_processing(), which reads it back, writes into it, then performs
appctx_strm(sa->owner)->parent = NULL and appctx_wakeup(sa->owner). As
<owner> sits at offset 0, right where pool_free() stores its cache linkage,
it is not even NULL but points into the pool cache, so these two writes go
through a bogus appctx. An allocation failure is needed to reach this,
either the appctx itself or the session/stream set up by spoe_init_appctx().

Let's simply clear ctx->spoe_appctx before releasing the applet context.

This was introduced in 3.1 by commit 07cf7769c ("MEDIUM: spoe: Directly
xfer NOTIFY frame when SPOE applet is created"). It must be backported to
3.1.

Reported-by: Claude (ANT-2026-KBZN81X2)

diff --git a/src/flt_spoe.c b/src/flt_spoe.c
index 706c5c8f8a89c8ac746b6c2058a637e943a76e76..cc107d18a7bd5167de50f7e7f86cfdb65c8f958b 100644 (file)
--- a/src/flt_spoe.c
+++ b/src/flt_spoe.c
@@ -589,6 +589,11 @@ static struct appctx *spoe_create_appctx(struct spoe_context *ctx)
  out_free_appctx:
        appctx_free_on_early_error(appctx);
  out_free_spoe_appctx:
+       /* the context must not be left pointing to the applet we're about to
+        * release, the caller still uses it on the error path.
+        */
+       if (ctx->spoe_appctx == spoe_appctx)
+               ctx->spoe_appctx = NULL;
        pool_free(pool_head_spoe_appctx, spoe_appctx);
  out_error:
        send_log(&agent->fe, LOG_EMERG, "SPOE: [%s] failed to create SPOE applet\n", agent->id);