From: Amaury Denoyelle <adenoyelle@haproxy.com>
Date: Fri, 17 Jul 2026 14:12:42 +0000 (+0200)
Subject: BUG/MINOR: proxy: fix default-server leak on post-parsing cleanup
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=d705d3ba103d312d4b3e01f237ba3daa118f3c78;p=thirdparty%2Fhaproxy.git

BUG/MINOR: proxy: fix default-server leak on post-parsing cleanup

A proxy with BE capabilities may define a default-server instance. This
instance is freed when config parser switch to another section. Beside
the server object, <conf.file> is also freed.

This causes a memleak if the default-server configuration is expanded
with keywords triggering dynamic allocations. For example, this is the
case if a cookie name is defined.

To fix this, use srv_free_params() on default-server deletion. This
function is designed to work both for server and default-server. It
ensures that every dynamic elements in it are freed. Only <id> member is
not freed by srv_free_params() : this is expected as it is a static
value for default-server instances.

Note that srv_free_params() is already used when default-server is freed
in deinit_proxy() since the following patch. However, post-parsing
cleanup has been added after it without reusing srv_free_params().

  899b547840c340cd129c3831d3858d8d2e5b452a
  BUG/MINOR: proxy/server: free default-server on deinit

This should be backported up to 2.8. Prior to it, srv_free_params() does
not exists, so it cannot be picked as is.
---

diff --git a/src/proxy.c b/src/proxy.c
index ad25446e9..2de25245f 100644
--- a/src/proxy.c
+++ b/src/proxy.c
@@ -2900,7 +2900,7 @@ static void defaults_px_free(struct proxy *defproxy)
 
 	/* default proxy specific cleanup */
 	if (defproxy->defsrv)
-		ha_free((char **)&defproxy->defsrv->conf.file);
+		srv_free_params(defproxy->defsrv);
 	ha_free(&defproxy->defbe.name);
 	srv_free(&defproxy->defsrv);
 
@@ -4305,7 +4305,7 @@ static int post_section_px_cleanup()
 		 */
 
 		if (curproxy->defsrv) {
-			ha_free((char **)&curproxy->defsrv->conf.file);
+			srv_free_params(curproxy->defsrv);
 			srv_free(&curproxy->defsrv);
 		}
 	}