From: Olivier Houchard <ohouchard@haproxy.com>
Date: Thu, 6 Aug 2026 07:26:05 +0000 (+0200)
Subject: BUG/MEDIUM: spoe: clear the applet pointer when the applet fails to start
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=c4184069d4cd2cd21090664825c030455de6e948;p=thirdparty%2Fhaproxy.git

BUG/MEDIUM: spoe: clear the applet pointer when the applet fails to start

spoe_create_appctx() assigns the freshly allocated spoe_appctx to
ctx->spoe_appctx before creating and initializing the applet, both of which
may fail. On these error paths the spoe_appctx is released but the pointer
is left in the SPOE context, and the caller reports the failure through
spoe_stop_processing(), which reads it back, writes into it, then performs
appctx_strm(sa->owner)->parent = NULL and appctx_wakeup(sa->owner). As
<owner> sits at offset 0, right where pool_free() stores its cache linkage,
it is not even NULL but points into the pool cache, so these two writes go
through a bogus appctx. An allocation failure is needed to reach this,
either the appctx itself or the session/stream set up by spoe_init_appctx().

Let's simply clear ctx->spoe_appctx before releasing the applet context.

This was introduced in 3.1 by commit 07cf7769c ("MEDIUM: spoe: Directly
xfer NOTIFY frame when SPOE applet is created"). It must be backported to
3.1.

Reported-by: Claude (ANT-2026-KBZN81X2)
---

diff --git a/src/flt_spoe.c b/src/flt_spoe.c
index 706c5c8f8..cc107d18a 100644
--- a/src/flt_spoe.c
+++ b/src/flt_spoe.c
@@ -589,6 +589,11 @@ static struct appctx *spoe_create_appctx(struct spoe_context *ctx)
  out_free_appctx:
 	appctx_free_on_early_error(appctx);
  out_free_spoe_appctx:
+	/* the context must not be left pointing to the applet we're about to
+	 * release, the caller still uses it on the error path.
+	 */
+	if (ctx->spoe_appctx == spoe_appctx)
+		ctx->spoe_appctx = NULL;
 	pool_free(pool_head_spoe_appctx, spoe_appctx);
  out_error:
 	send_log(&agent->fe, LOG_EMERG, "SPOE: [%s] failed to create SPOE applet\n", agent->id);