tree feccfc49a0971069d0b53582b8e12695437f03e1
parent 263013d031d754c9f96de0d0cb5afcc011af6441
author Willy Tarreau <w@1wt.eu> 1431511701 +0200
committer Willy Tarreau <w@1wt.eu> 1431523894 +0200
encoding latin1

BUG/MAJOR: checks: always check for end of list before proceeding

This is the most important fix of this series. There's a risk of endless
loop and crashes caused by the fact that we go past the head of the list
when skipping to next rule, without checking if it's still a valid element.
Most of the time, the ->action field is checked, which points to the proxy's
check_req pointer (generally NULL), meaning the element is confused with a
TCPCHK_ACT_SEND action.

The situation was accidently made worse with the addition of tcp-check
comment since it also skips list elements. However, since the action that
makes it go forward is TCPCHK_ACT_COMMENT (3), there's little chance to
see this as a valid pointer, except on 64-bit machines where it can match
the end of a check_req string pointer.

This fix heavily depends on previous cleanup and both must be backported
to 1.5 where the bug is present.