From: Frederic Lecaille <flecaille@haproxy.com>
Date: Wed, 12 Aug 2026 13:04:58 +0000 (+0200)
Subject: BUG/MINOR: server: fix memory leak on "default-server" parsing failures
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=93599eca13e8f66041af06b64f6443d3be3e9ac4;p=thirdparty%2Fhaproxy.git

BUG/MINOR: server: fix memory leak on "default-server" parsing failures

This is a fix for very minor bug which may be triggerd only at parsing time
upon parsing failures (allocation failure, or default server name mismatch).

When parsing a named "default-server" instance in _srv_parse_init(), <name> is
allocated via strdup(). If a name mismatch occurs or if srv_alloc() fails,
the function jumps to the <out> label without freeing this string.

Fix this by initializing <name> to NULL at the function start and calling
free(name) in the <out> cleanup block.

This issue was reported by GH #3462.

No need to backport.
---

diff --git a/src/server.c b/src/server.c
index 5826711cc..1090b2307 100644
--- a/src/server.c
+++ b/src/server.c
@@ -3697,6 +3697,8 @@ static int _srv_parse_init(struct server **srv, char **args, int *cur_arg,
 	int alt_proto = 0;
 	int tmpl_range_low = 0, tmpl_range_high = 0;
 	char *errmsg = NULL;
+	char *name = NULL;
+
 
 	*srv = NULL;
 
@@ -3892,8 +3894,6 @@ static int _srv_parse_init(struct server **srv, char **args, int *cur_arg,
 		HA_SPIN_INIT(&newsrv->lock);
 	}
 	else {
-		char *name;
-
 		/* Parse optional "name" default-server keyword. */
 		if (*args[1] && strcmp(args[1], "name") == 0) {
 			if (!*args[2]) {
@@ -3918,7 +3918,6 @@ static int _srv_parse_init(struct server **srv, char **args, int *cur_arg,
 		else {
 			/* unnamed default-server instance */
 			*cur_arg = 1;
-			name = NULL;
 			newsrv = curproxy->defsrv;
 		}
 
@@ -3957,6 +3956,7 @@ static int _srv_parse_init(struct server **srv, char **args, int *cur_arg,
 	return 0;
 
 out:
+	free(name);
 	free(fqdn);
 	return err_code;
 }