tree dbc8b2b93936945bc423ed6d151d3fe14c5fcd08
parent f611248d8cc00054c63e831e0dce9c8ad822a133
author Christopher Faulet <cfaulet@haproxy.com> 1661869669 +0200
committer Christopher Faulet <cfaulet@haproxy.com> 1661869671 +0200

BUG/MEDIUM: ssl: Fix a UAF when old ckch instances are released

When old chck instances is released at the end of "commit ssl ca-file" or
"commit ssl crl-file" commands, the link is released. But we walk through
the list using the unsafe macro. list_for_each_entry_safe() must be used.

This bug was introduced by commit 056ad01d5 ("BUG/MINOR: ssl: leak of
ckch_inst_link in ckch_inst_free()"). Thus this patch must be backported as
far as 2.5.