From: Willy Tarreau <w@1wt.eu>
Date: Mon, 20 Oct 2025 12:50:27 +0000 (+0200)
Subject: BUG/MEDIUM: cli: also free the trash chunk on the error path
X-Git-Tag: v3.3-dev11~80
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=e63e98f1d83547fa2911ff896c1e33d9cfbcf58e;p=thirdparty%2Fhaproxy.git

BUG/MEDIUM: cli: also free the trash chunk on the error path

Since commit 20ec1de214 ("MAJOR: cli: Refacor parsing and execution of
pipelined commands"), command not returning any response (e.g. "quit")
don't pass through the free_trash_chunk() call, possibly leaking the
cmdline buffer. A typical way to reproduce it is to loop on "quit" on
the CLI, though it very likely affects other specific commands.

Let's make sure in the release handler that we always release that
chunk in any case. This must be backported to 3.2.
---

diff --git a/src/cli.c b/src/cli.c
index 331764531..fcb995a01 100644
--- a/src/cli.c
+++ b/src/cli.c
@@ -1310,6 +1310,8 @@ void cli_io_handler(struct appctx *appctx)
  */
 static void cli_release_handler(struct appctx *appctx)
 {
+	free_trash_chunk(appctx->cli_ctx.cmdline);
+
 	if (appctx->cli_ctx.io_release) {
 		appctx->cli_ctx.io_release(appctx);
 		appctx->cli_ctx.io_release = NULL;