From: scientiamobile <haproxy@scientiamobile.com>
Date: Tue, 11 Aug 2026 10:15:39 +0000 (+0200)
Subject: BUG/MINOR: wurfl: fix memory leak of information list and patch strings at deinit
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=a139938ec01f1577529b94b971b641754d860e62;p=thirdparty%2Fhaproxy.git

BUG/MINOR: wurfl: fix memory leak of information list and patch strings at deinit

The strings duplicated with strdup() for each "wurfl-information-list" token
(wi->data.name) and each "wurfl-patch-file" path (wp->patch_file_path) were
never freed: ha_wurfl_deinit() only freed the list nodes, not the strings they
own. A simple config check on a configuration using these keywords is enough to
leak them, as reported by ASAN.

Free wi->data.name and wp->patch_file_path before freeing their list nodes.

This bug has been present since the module was introduced in commit d0027ed5b
("MEDIUM: wurfl: add Scientiamobile WURFL device detection module"). It should
be backported to all stable versions.

This fixes issue #2084.
Reported-by: Ilya Shipitsin <chipitsine@gmail.com>
---

diff --git a/addons/wurfl/wurfl.c b/addons/wurfl/wurfl.c
index 4df647390..31a61c4a6 100644
--- a/addons/wurfl/wurfl.c
+++ b/addons/wurfl/wurfl.c
@@ -413,11 +413,13 @@ static void ha_wurfl_deinit(void)
 
 	list_for_each_entry_safe(wi, wi2, &global_wurfl.information_list, list) {
 		LIST_DELETE(&wi->list);
+		free(wi->data.name);
 		free(wi);
 	}
 
 	list_for_each_entry_safe(wp, wp2, &global_wurfl.patch_file_list, list) {
 		LIST_DELETE(&wp->list);
+		free(wp->patch_file_path);
 		free(wp);
 	}