tree 9418c5a56e769b1527d4e174406049b0f8727261
parent d16e7dd0e4cf07c9731a1a1c288d003a9f84d1b5
author Emeric Brun <ebrun@haproxy.com> 1634650810 +0200
committer Willy Tarreau <w@1wt.eu> 1634745122 +0200
encoding latin1

BUG/MAJOR: dns: tcp session can remain attached to a list after a free

Using tcp, after a session release and free, the session can remain
attached to the list of sessions with a response message waiting for
a commit (ds->waiter). This results to a use after free of this
session.

Also, on some error path and after free, a session could remain attached
to the lists of available idle/free sessions (ds->list).

This patch ensure to remove the session from those external lists
before a free.

This patch should be backported to all version including
the dns over tcp (2.4)