From: Emeric Brun <ebrun@haproxy.com>
Date: Wed, 1 Dec 2021 11:08:42 +0000 (+0100)
Subject: BUG/MAJOR: segfault using multiple log forward sections.
X-Git-Tag: v2.6-dev1~332
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=2ad2b1c94cc7bb88b879fb0895a3bee566fdf053;p=thirdparty%2Fhaproxy.git

BUG/MAJOR: segfault using multiple log forward sections.

For each new log forward section, the proxy was added to the log forward
proxy list but the ref on the previous log forward section's proxy was
scratched using "init_new_proxy" which performs a memset. After configuration
parsing this list contains only the last section's proxy.

The post processing walk through this list to resolve "ring" names.
Since some section's proxies are missing in this list, the resolving
is not done for those ones and the pointer on the ring is kept to null
causing a segfault at runtime trying to write a log message
into the ring.

This patch shift the "init_new_proxy" before adding the ref on the
previous log forward section's proxy on currently parsed one.

This patch shoud fix github issue #1464

This patch should be backported to 2.3
---

diff --git a/src/log.c b/src/log.c
index ecf771221d..92eef6ebeb 100644
--- a/src/log.c
+++ b/src/log.c
@@ -3738,10 +3738,9 @@ int cfg_parse_log_forward(const char *file, int linenum, char **args, int kwm)
 			goto out;
 		}
 
+		init_new_proxy(px);
 		px->next = cfg_log_forward;
 		cfg_log_forward = px;
-
-		init_new_proxy(px);
 		px->conf.file = strdup(file);
 		px->conf.line = linenum;
 		px->mode = PR_MODE_SYSLOG;