From: Christopher Faulet <cfaulet@haproxy.com>
Date: Fri, 13 Sep 2019 08:01:36 +0000 (+0200)
Subject: BUG/MINOR: backend: Fix a possible null pointer dereference
X-Git-Tag: v2.1-dev2~83
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=1dbc4676c657072dfbf89a0b7ce9699367f28b33;p=thirdparty%2Fhaproxy.git

BUG/MINOR: backend: Fix a possible null pointer dereference

In the function connect_server(), when we are not able to reuse a connection and
too many FDs are opened, the variable srv must be defined to kill an idle
connection.

This patch fixes the issue #257. It must be backported to 2.0
---

diff --git a/src/backend.c b/src/backend.c
index 1b01536c1d..f03b1ab659 100644
--- a/src/backend.c
+++ b/src/backend.c
@@ -1268,7 +1268,7 @@ int connect_server(struct stream *s)
 	}
 
 	if (((!reuse || (srv_conn && !(srv_conn->flags & CO_FL_CONNECTED)))
-	    && ha_used_fds > global.tune.pool_high_count) && srv->idle_orphan_conns) {
+	    && ha_used_fds > global.tune.pool_high_count) && srv && srv->idle_orphan_conns) {
 		struct connection *tokill_conn;
 
 		/* We can't reuse a connection, and e have more FDs than deemd