BUG/MAJOR: stick-counters: possible crash when using sc_trackers with wrong table
Bryan Talbot reported a very interesting bug. The sc_trackers() sample
fetch seems to have escaped the sanitization that was performed during 1.5
to ensure all dereferences of stkctr_entry() were safe. Here if a tacker
is set on a backend and is then checked against a different backend where
the entry doesn't exist, stkctr_entry() returns NULL and this is dereferenced
to retrieve the ref count. Thanks to Bryan for his detailed bug report featuring
a working config and reproducer.
This fix must be backported to 1.6 and 1.5.
(cherry picked from commit 4d03ef7f0319c5f73cbcb1d5c3025923226a1536)
(cherry picked from commit 89e3864c224c61369e9e33e31c53576bdc80ed6a)
diff --git a/src/session.c b/src/session.c
index 24acb71..2a1fdb3 100644
--- a/src/session.c
+++ b/src/session.c
@@ -3337,7 +3337,7 @@
smp->flags = SMP_F_VOL_TEST;
smp->type = SMP_T_UINT;
- smp->data.uint = stkctr_entry(stkctr)->ref_cnt;
+ smp->data.uint = stkctr_entry(stkctr) ? stkctr_entry(stkctr)->ref_cnt : 0;
return 1;
}