BUG/MINOR: resolvers: fix dangling list pointer in resolvers_new() error paths

The resolver 'r' is appended to the global sec_resolvers list, but upon failure
later, pointers are released but the element remains in the list, corrupting it,
and possibly causing a crash during deinit() when releasing remaining ones.
Adding a LIST_DEL_INIT() on the error unrolling path is sufficient.

Note that the issue will only happen on failure to allocate memory via
strdup() so the risk is low. The bug was introduced in 2.6 by commit
e7f5776800 ("MINOR: resolvers: resolvers_new() create a resolvers with
default values"), so the fix may be backported to several releases, but
does not necessarily have to go that far.

diff --git a/src/resolvers.c b/src/resolvers.c
index 1d3d788a9f12120044aaefeb750cf0517117562b..f7e6fa04ec1f072db4934f4bcbb80c578c34a7a5 100644 (file)
--- a/src/resolvers.c
+++ b/src/resolvers.c
@@ -3669,6 +3669,7 @@ err_free_conf_file:
        ha_free((void **)&r->conf.file);
 err_free_p:
        proxy_drop(p);
+       LIST_DEL_INIT(&r->list);
 err_free_r:
        ha_free(&r);
        return err_code;