From: Thierry FOURNIER <tfournier@exceliance.fr>
Date: Mon, 14 Apr 2014 23:15:52 +0000 (+0200)
Subject: BUG/MAJOR: session: fix a possible crash with src_tracked
X-Git-Tag: v1.5-dev23~43
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=d988f21589b1fd215bba4f72a11d656d5d50b77c;p=thirdparty%2Fhaproxy.git

BUG/MAJOR: session: fix a possible crash with src_tracked

Since commit 4d4149c ("MEDIUM: counters: support passing the counter
number as a fetch argument"), the sample fetch sc_tracked(num) became
equivalent to sc[0-9]_tracked, by using the same smp_fetch_sc_tracked()
function.

This was theorically made possible after the series of changes starting
with commit a65536ca ("MINOR: counters: provide a generic function to
retrieve a stkctr for sc* and src."). Unfortunately, while all other
functions were changed to use the generic primitive smp_fetch_sc_stkctr(),
smp_fetch_sc_tracked() was forgotten and is not able to differentiate
between sc_tracked, src_tracked and sc[0-9]_tracked. The resulting mess is
that if sc_tracked is used, the counter number is assumed to be 47 because
that's what remains after subtracting "0" from char "_".

Fix this by simply relying on the generic function as should have been
done. The bug was introduced in 1.5-dev20. No backport is needed.
---

diff --git a/src/session.c b/src/session.c
index 99f7558ae8..b85f55471b 100644
--- a/src/session.c
+++ b/src/session.c
@@ -2692,7 +2692,7 @@ smp_fetch_sc_tracked(struct proxy *px, struct session *l4, void *l7, unsigned in
 {
 	smp->flags = SMP_F_VOL_TEST;
 	smp->type = SMP_T_BOOL;
-	smp->data.uint = !!stkctr_entry(&l4->stkctr[kw[2] - '0']);
+	smp->data.uint = !!smp_fetch_sc_stkctr(l4, args, kw);
 	return 1;
 }