From: Willy Tarreau <w@1wt.eu>
Date: Thu, 14 May 2026 22:59:58 +0000 (+0000)
Subject: BUG/MINOR: resolvers: fix dangling list pointer in resolvers_new() error paths
X-Git-Tag: v3.4-dev13~68
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=493dc352ad70988ebbcd01c4f406443973071940;p=thirdparty%2Fhaproxy.git

BUG/MINOR: resolvers: fix dangling list pointer in resolvers_new() error paths

The resolver 'r' is appended to the global sec_resolvers list, but upon failure
later, pointers are released but the element remains in the list, corrupting it,
and possibly causing a crash during deinit() when releasing remaining ones.
Adding a LIST_DEL_INIT() on the error unrolling path is sufficient.

Note that the issue will only happen on failure to allocate memory via
strdup() so the risk is low. The bug was introduced in 2.6 by commit
e7f5776800 ("MINOR: resolvers: resolvers_new() create a resolvers with
default values"), so the fix may be backported to several releases, but
does not necessarily have to go that far.
---

diff --git a/src/resolvers.c b/src/resolvers.c
index 1d3d788a9..f7e6fa04e 100644
--- a/src/resolvers.c
+++ b/src/resolvers.c
@@ -3669,6 +3669,7 @@ err_free_conf_file:
 	ha_free((void **)&r->conf.file);
 err_free_p:
 	proxy_drop(p);
+	LIST_DEL_INIT(&r->list);
 err_free_r:
 	ha_free(&r);
 	return err_code;