BUG/MEDIUM: applet: only set appctx->sedesc on successful allocation
If appctx_new_on() fails to allocate a task, it will not remove the
freshly allocated sedesc from the appctx despite freeing it, causing
a UAF. Let's only assign appctx->sedesc upon success.
This needs to be backported to 2.6. In 2.6 the function is slightly
different and called appctx_new(), though the issue is exactly the
same.
diff --git a/src/applet.c b/src/applet.c
index 2900013..b7e9920 100644
--- a/src/applet.c
+++ b/src/applet.c
@@ -48,6 +48,7 @@
appctx->obj_type = OBJ_TYPE_APPCTX;
appctx->applet = applet;
appctx->sess = NULL;
+ appctx->sedesc = NULL;
if (!sedesc) {
sedesc = sedesc_new();
if (!sedesc)
@@ -55,11 +56,12 @@
sedesc->se = appctx;
se_fl_set(sedesc, SE_FL_T_APPLET | SE_FL_ORPHAN);
}
- appctx->sedesc = sedesc;
appctx->t = task_new_on(thr);
if (unlikely(!appctx->t))
goto fail_task;
+
+ appctx->sedesc = sedesc;
appctx->t->process = task_run_applet;
appctx->t->context = appctx;