From: Andrei Pavel <andrei@isc.org>
Date: Tue, 28 Oct 2025 07:48:04 +0000 (+0200)
Subject: [#3451] Fix memory access violation
X-Git-Tag: Kea-3.1.3~1
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=0a4f8adabd8db0004658c85ad5085a9dfd8b34d6;p=thirdparty%2Fkea.git

[#3451] Fix memory access violation

The success boolean from the sync-leases callback was accessed from the
complete-notify callback.
---

diff --git a/src/hooks/dhcp/high_availability/ha_service.cc b/src/hooks/dhcp/high_availability/ha_service.cc
index 9321637733..36ddc78d8c 100644
--- a/src/hooks/dhcp/high_availability/ha_service.cc
+++ b/src/hooks/dhcp/high_availability/ha_service.cc
@@ -2426,22 +2426,22 @@ HAService::synchronize(std::string& status_message,
             // partner.
             if (success) {
                 asyncSyncCompleteNotify(client, remote_config,
-                                        [&](const bool /* success */,
-                                            const std::string& error_message_1,
+                                        [&](const bool success_complete_notify,
+                                            const std::string& error_message_complete_notify,
                                             const int rcode) {
                     // This command may not be supported by the partner when it
                     // runs an older Kea version. In that case, send the dhcp-enable
                     // command as in previous Kea version.
                     if (rcode == CONTROL_RESULT_COMMAND_UNSUPPORTED) {
                         asyncEnableDHCPService(client, remote_config,
-                                               [&](const bool is_success,
-                                                   const std::string& error_message_2,
+                                               [&](const bool success_enable_dhcp,
+                                                   const std::string& error_message_enable_dhcp,
                                                    const int) {
                             // It is possible that we have already recorded an error
                             // message while synchronizing the lease database. Don't
                             // override the existing error message.
-                            if (!is_success && status_message.empty()) {
-                                status_message = error_message_2;
+                            if (!success_enable_dhcp && status_message.empty()) {
+                                status_message = error_message_enable_dhcp;
                             }
 
                             // The synchronization process is completed, so let's break
@@ -2453,8 +2453,8 @@ HAService::synchronize(std::string& status_message,
                     } else {
                         // ha-sync-complete-notify command was delivered to the partner.
                         // The synchronization process ends here.
-                        if (!success && status_message.empty()) {
-                            status_message = error_message_1;
+                        if (!success_complete_notify && status_message.empty()) {
+                            status_message = error_message_complete_notify;
                         }
 
                         io_service->stop();
@@ -2467,11 +2467,11 @@ HAService::synchronize(std::string& status_message,
                 // ha-sync-complete-notify command in this case. It is only sent in
                 // the case when synchronization ends successfully.
                 asyncEnableDHCPService(client, remote_config,
-                                       [&](const bool is_success,
-                                           const std::string& error_message_1,
+                                       [&](const bool success_enable_dhcp,
+                                           const std::string& error_message_enable_dhcp,
                                            const int) {
-                    if (!is_success && status_message.empty()) {
-                        status_message = error_message_1;
+                    if (!success_enable_dhcp && status_message.empty()) {
+                        status_message = error_message_enable_dhcp;
                     }
 
                     // The synchronization process is completed, so let's break