]> git.ipfire.org Git - thirdparty/haproxy.git/commitdiff
BUG/MINOR: sample: fix memory leak in smp_resolve_args error paths
authorWilly Tarreau <w@1wt.eu>
Sun, 26 Apr 2026 21:55:03 +0000 (23:55 +0200)
committerWilly Tarreau <w@1wt.eu>
Mon, 27 Apr 2026 12:44:29 +0000 (14:44 +0200)
Several error paths in smp_resolve_args used 'continue' which skipped
LIST_DELETE and free(cur), leaking the arg_list node. Changed all to
'break' to ensure proper cleanup on all error paths. This is harmless
since when such issues are met, the process refuses to start, so no
backport is really needed.

src/sample.c

index b6ec6ec77216891f0d03d5f74f2b5ca9ff180aee..154adbde84fa23295f54a78d2ba6aff873e0097e 100644 (file)
@@ -1489,7 +1489,7 @@ int smp_resolve_args(struct proxy *p, char **err)
                                         cur->arg_pos + 1, conv_pre, conv_ctx, conv_pos, ctx, cur->kw, where, p->id, err2);
                                ha_free(&err2);
                                cfgerr++;
-                               continue;
+                               break;
                        }
                        break;
 
@@ -1499,7 +1499,7 @@ int smp_resolve_args(struct proxy *p, char **err)
                                         *err ? *err : "", cur->file, cur->line,
                                         cur->arg_pos + 1, conv_pre, conv_ctx, conv_pos, ctx, cur->kw, where, p->id);
                                cfgerr++;
-                               continue;
+                               break;
                        }
 
                        /* we support two formats : "bck/srv" and "srv" */
@@ -1682,7 +1682,7 @@ int smp_resolve_args(struct proxy *p, char **err)
                                         *err ? *err : "", cur->file, cur->line,
                                         cur->arg_pos + 1, conv_pre, conv_ctx, conv_pos, ctx, cur->kw, where, p->id);
                                cfgerr++;
-                               continue;
+                               break;
                        }
 
                        rflags = 0;
@@ -1696,7 +1696,7 @@ int smp_resolve_args(struct proxy *p, char **err)
                                         cur->arg_pos + 1, conv_pre, conv_ctx, conv_pos, ctx, cur->kw, where, p->id, err2);
                                ha_free(&err2);
                                cfgerr++;
-                               continue;
+                               break;
                        }
 
                        chunk_destroy(&arg->data.str);