From: Remi Tricot-Le Breton <rlebreton@haproxy.com>
Date: Wed, 19 May 2021 08:45:12 +0000 (+0200)
Subject: BUG/MINOR: worker: Missing calloc return value check in mworker_env_to_proc_list
X-Git-Tag: v2.5-dev1~218
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=1f4fa906c73e61dba74f9e8b762da12df3052f57;p=thirdparty%2Fhaproxy.git

BUG/MINOR: worker: Missing calloc return value check in mworker_env_to_proc_list

A memory allocation failure happening in mworker_env_to_proc_list when
trying to allocate a mworker_proc would have resulted in a crash. This
function is only called during init.

It was raised in GitHub issue #1233.
It could be backported to all stable branches.
---

diff --git a/include/haproxy/mworker.h b/include/haproxy/mworker.h
index 434077c0c0..279fb085da 100644
--- a/include/haproxy/mworker.h
+++ b/include/haproxy/mworker.h
@@ -20,7 +20,7 @@
 extern struct mworker_proc *proc_self;
 
 void mworker_proc_list_to_env();
-void mworker_env_to_proc_list();
+int mworker_env_to_proc_list();
 
 
 void mworker_block_signals();
diff --git a/src/haproxy.c b/src/haproxy.c
index 71866eb17d..0e707f5ef4 100644
--- a/src/haproxy.c
+++ b/src/haproxy.c
@@ -1892,8 +1892,10 @@ static void init(int argc, char **argv)
 	if (global.mode & (MODE_MWORKER|MODE_MWORKER_WAIT)) {
 		struct wordlist *it, *c;
 
-		mworker_env_to_proc_list(); /* get the info of the children in the env */
-
+		/* get the info of the children in the env */
+		if (mworker_env_to_proc_list() < 0) {
+			exit(EXIT_FAILURE);
+		}
 
 		if (!LIST_ISEMPTY(&mworker_cli_conf)) {
 
diff --git a/src/mworker.c b/src/mworker.c
index 2360337616..991394c48b 100644
--- a/src/mworker.c
+++ b/src/mworker.c
@@ -131,13 +131,13 @@ void mworker_proc_list_to_env()
 /*
  * unserialize the proc list from the environment
  */
-void mworker_env_to_proc_list()
+int mworker_env_to_proc_list()
 {
 	char *msg, *token = NULL, *s1;
 
 	msg = getenv("HAPROXY_PROCESSES");
 	if (!msg)
-		return;
+		return 0;
 
 	while ((token = strtok_r(msg, "|", &s1))) {
 		struct mworker_proc *child;
@@ -147,6 +147,10 @@ void mworker_env_to_proc_list()
 		msg = NULL;
 
 		child = calloc(1, sizeof(*child));
+		if (!child) {
+			ha_alert("Out of memory while trying to allocate a worker process structure.");
+			return -1;
+		}
 
 		while ((subtoken = strtok_r(token, ";", &s2))) {
 
@@ -193,6 +197,8 @@ void mworker_env_to_proc_list()
 	}
 
 	unsetenv("HAPROXY_PROCESSES");
+
+	return 0;
 }
 
 /* Signal blocking and unblocking */