commit 4bf6d76a22b9b601fd57df4aa0f4fba62733cb07 Author: Willy Tarreau Date: Mon Oct 15 11:08:55 2018 +0200 BUG/MEDIUM: stream: don't crash on out-of-memory In case pool_alloc() fails in stream_new(), we try to detach the stream from the list before it has been added, dereferencing a NULL. In order to fix it, simply move the LIST_DEL call upwards. This must be backported to 1.8. (cherry picked from commit e5f229e6392fd54aaba7fe58f457723c16b9d15f) Signed-off-by: Willy Tarreau diff --git a/src/stream.c b/src/stream.c index 11c9dbf3..ef7cff5c 100644 --- a/src/stream.c +++ b/src/stream.c @@ -282,8 +282,8 @@ struct stream *stream_new(struct session *sess, enum obj_type *origin) out_fail_accept: flt_stream_release(s, 0); task_free(t); - out_fail_alloc: LIST_DEL(&s->list); + out_fail_alloc: pool_free(pool_head_stream, s); return NULL; }