From: Willy Tarreau <w@1wt.eu>
Date: Tue, 12 May 2015 09:57:07 +0000 (+0200)
Subject: BUG/MAJOR: check: fix breakage of inverted tcp-check rules
X-Git-Tag: v1.6-dev2~120
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=6296a11ea416d6360226c27241713c0f6dc0a2ae;p=thirdparty%2Fhaproxy.git

BUG/MAJOR: check: fix breakage of inverted tcp-check rules

Recent commit 22b09d2 ("MINOR: include comment in tcpcheck error log")
accidently left a double-step to the next rule in case of an inverted
rule. The effect is that an inverted rule is necessarily skipped and
that we can crash if it was the last rule since we'd use as a rule the
head of the list, thus dereference random memory contents.

No backport is needed.
---

diff --git a/src/checks.c b/src/checks.c
index 26cccae760..249df276ce 100644
--- a/src/checks.c
+++ b/src/checks.c
@@ -2820,8 +2820,6 @@ static void tcpcheck_main(struct connection *conn)
 
 					check->current_step = cur;
 
-					cur = (struct tcpcheck_rule*)cur->list.n;
-					check->current_step = cur;
 					if (check->current_step->action == TCPCHK_ACT_EXPECT)
 						goto tcpcheck_expect;
 					__conn_data_stop_recv(conn);