From: Emeric Brun <ebrun@haproxy.com>
Date: Wed, 25 May 2022 08:25:45 +0000 (+0200)
Subject: BUG/MEDIUM: peers: prevent unitialized multiple listeners on peers section
X-Git-Tag: v2.6-dev12~138
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=ca82578fe82bc8fadec675efc60b56e2cea4feaf;p=thirdparty%2Fhaproxy.git

BUG/MEDIUM: peers: prevent unitialized multiple listeners on peers section

The previous fix:
BUG/MEDIUM: peers: fix segfault using multiple bind on peers

Prevents to declare multiple listeners on a peers sections but if
peers protocol is extended to support this we could raise the bug
again.

Indeed, after allocating a new listener and adding it to a list the
code mistakenly re-configure the first element of the list instead
of the new added one, and the last one remains finally uninitialized.
The previous fix assure there is no more than one listener in this
list but this could be changed in futur.

This patch patch assures we configure and initialize the newly added
listener instead of the first one in the list.

This patch could be backported until version 2.0 to complete
BUG/MEDIUM: peers: fix segfault using multiple bind on peers
---

diff --git a/src/cfgparse.c b/src/cfgparse.c
index 52bf2ffddb..8b2bfc9a9a 100644
--- a/src/cfgparse.c
+++ b/src/cfgparse.c
@@ -729,7 +729,10 @@ int cfg_parse_peers(const char *file, int linenum, char **args, int kwm)
 				err_code |= ERR_FATAL;
 				goto out;
 			}
-			l = LIST_ELEM(bind_conf->listeners.n, typeof(l), by_bind);
+			/*
+			 * Newly allocated listener is at the end of the list
+			 */
+			l = LIST_ELEM(bind_conf->listeners.p, typeof(l), by_bind);
 			l->maxaccept = 1;
 			l->accept = session_accept_fd;
 			l->analysers |=  curpeers->peers_fe->fe_req_ana;
@@ -933,7 +936,10 @@ int cfg_parse_peers(const char *file, int linenum, char **args, int kwm)
 			goto out;
 		}
 
-		l = LIST_ELEM(bind_conf->listeners.n, typeof(l), by_bind);
+		/*
+		 * Newly allocated listener is at the end of the list
+		 */
+		l = LIST_ELEM(bind_conf->listeners.p, typeof(l), by_bind);
 		l->maxaccept = 1;
 		l->accept = session_accept_fd;
 		l->analysers |=  curpeers->peers_fe->fe_req_ana;