You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

43 lines
1.8 KiB

  1. commit e725a7f9bfd8b7fe2e74c62c7c6bf2b9ebf83772
  2. Author: Willy Tarreau <w@1wt.eu>
  3. Date: Wed Oct 3 10:20:19 2018 +0200
  4. BUG/MINOR: backend: check that the mux installed properly
  5. The return value from conn_install_mux() was not checked, so if an
  6. inconsistency happens in the code, or a memory allocation fails while
  7. initializing the mux, we can crash while using an uninitialized mux.
  8. In practice the code inconsistency does not really happen since we
  9. cannot configure such a situation, except during development, but
  10. the out of memory condition could definitely happen.
  11. This should be backported to 1.8 (the code is a bit different there,
  12. there are two calls to conn_install_mux()).
  13. (cherry picked from commit 33dd4ef81245bb868b22f99b9be45d0791131eec)
  14. Signed-off-by: Christopher Faulet <cfaulet@haproxy.com>
  15. diff --git a/src/backend.c b/src/backend.c
  16. index 2b6167dc..fc1eac0d 100644
  17. --- a/src/backend.c
  18. +++ b/src/backend.c
  19. @@ -1163,7 +1163,8 @@ int connect_server(struct stream *s)
  20. if (srv) {
  21. conn_prepare(srv_conn, protocol_by_family(srv_conn->addr.to.ss_family), srv->xprt);
  22. /* XXX: Pick the right mux, when we finally have one */
  23. - conn_install_mux(srv_conn, &mux_pt_ops, srv_cs);
  24. + if (conn_install_mux(srv_conn, &mux_pt_ops, srv_cs) < 0)
  25. + return SF_ERR_INTERNAL;
  26. }
  27. else if (obj_type(s->target) == OBJ_TYPE_PROXY) {
  28. /* proxies exclusively run on raw_sock right now */
  29. @@ -1171,7 +1172,8 @@ int connect_server(struct stream *s)
  30. if (!objt_cs(s->si[1].end) || !objt_cs(s->si[1].end)->conn->ctrl)
  31. return SF_ERR_INTERNAL;
  32. /* XXX: Pick the right mux, when we finally have one */
  33. - conn_install_mux(srv_conn, &mux_pt_ops, srv_cs);
  34. + if (conn_install_mux(srv_conn, &mux_pt_ops, srv_cs) < 0)
  35. + return SF_ERR_INTERNAL;
  36. }
  37. else
  38. return SF_ERR_INTERNAL; /* how did we get there ? */