BUG/MEDIUM: sink: invalid server list in sink_new_from_logsrv()
forward proxy server list created from sink_new_from_logsrv() is invalid
Indeed, srv->next is literally assigned to itself. This did not cause
issues during syslog handling because the sft was properly set, but it
will cause the free_proxy(sink->forward_px) at deinit to go wild since
free_proxy() will try to iterate through the proxy srv list to free
ressources, but because of the improper list initialization, double-free
and infinite-loop will occur.
This bug was revealed by 9b1d15f53a ("BUG/MINOR: sink: free forward_px on deinit()")
It must be backported as far as 2.4.
(cherry picked from commit 999699a277d85e875c5351cfe949c851f574f007)
Signed-off-by: Christopher Faulet <cfaulet@haproxy.com>
(cherry picked from commit aff4ac2e4a03876c8a63eb3c13eef6299e9801ec)
Signed-off-by: Christopher Faulet <cfaulet@haproxy.com>
(cherry picked from commit 22627e113d7f3fd5f25c0fd88c77328e88334fab)
Signed-off-by: Christopher Faulet <cfaulet@haproxy.com>
(cherry picked from commit 22e848ccaa9ac7373a3f72adc9c63dd8986f8ff0)
Signed-off-by: Christopher Faulet <cfaulet@haproxy.com>
diff --git a/src/sink.c b/src/sink.c
index 896019a..8b6904e 100644
--- a/src/sink.c
+++ b/src/sink.c
@@ -1023,8 +1023,8 @@
/* the servers are linked backwards
* first into proxy
*/
- p->srv = srv;
srv->next = p->srv;
+ p->srv = srv;
/* allocate sink_forward_target descriptor */
sft = calloc(1, sizeof(*sft));