BUG/MAJOR: session: fix a possible crash with src_tracked

Since commit 4d4149c ("MEDIUM: counters: support passing the counter
number as a fetch argument"), the sample fetch sc_tracked(num) became
equivalent to sc[0-9]_tracked, by using the same smp_fetch_sc_tracked()
function.

This was theorically made possible after the series of changes starting
with commit a65536ca ("MINOR: counters: provide a generic function to
retrieve a stkctr for sc* and src."). Unfortunately, while all other
functions were changed to use the generic primitive smp_fetch_sc_stkctr(),
smp_fetch_sc_tracked() was forgotten and is not able to differentiate
between sc_tracked, src_tracked and sc[0-9]_tracked. The resulting mess is
that if sc_tracked is used, the counter number is assumed to be 47 because
that's what remains after subtracting "0" from char "_".

Fix this by simply relying on the generic function as should have been
done. The bug was introduced in 1.5-dev20. No backport is needed.

diff --git a/src/session.c b/src/session.c
index 99f7558ae88ccfac2ed416dfaf652c703904d956..b85f55471b00730a6876270e376deaa2e33441d4 100644 (file)
--- a/src/session.c
+++ b/src/session.c
@@ -2692,7 +2692,7 @@ smp_fetch_sc_tracked(struct proxy *px, struct session *l4, void *l7, unsigned in
 {
        smp->flags = SMP_F_VOL_TEST;
        smp->type = SMP_T_BOOL;
-       smp->data.uint = !!stkctr_entry(&l4->stkctr[kw[2] - '0']);
+       smp->data.uint = !!smp_fetch_sc_stkctr(l4, args, kw);
        return 1;
 }