BUG/MINOR: cli: Fix memory leak on error for _getsocks command
authorChristopher Faulet <cfaulet@haproxy.com>
Thu, 6 Feb 2025 14:30:30 +0000 (15:30 +0100)
committerAmaury Denoyelle <adenoyelle@haproxy.com>
Tue, 18 Mar 2025 14:58:30 +0000 (15:58 +0100)
Some errors in parse function of _getsocks commands were not properly handled
and immediately returned, leading to a memory leak on cmsgbuf and tmpbuf
buffers.

To fix the issue, instead of immediately return with -1, we jump to "out"
label. Returning 1 intead of -1 in that case is valid.

This was reported by Coverity in #2841: CIDs 1587773 and 1587772.

This patch should be backported as far as 2.4.

(cherry picked from commit 372cc696d44e6853b9f7920f1c2d965736029764)
Signed-off-by: Willy Tarreau <w@1wt.eu>
(cherry picked from commit e9e1fbb7c858735e1376b069a8db7ca3b98f58ce)
Signed-off-by: Amaury Denoyelle <adenoyelle@haproxy.com>

src/cli.c

index 6f03e4f..b0b72c9 100644 (file)
--- a/src/cli.c
+++ b/src/cli.c
@@ -2399,7 +2399,7 @@ static int _getsocks(char **args, char *payload, struct appctx *appctx, void *pr
                        iov.iov_len = curoff;
                        if (sendmsg(fd, &msghdr, 0) != curoff) {
                                ha_warning("Failed to transfer sockets\n");
-                               return -1;
+                               goto out;
                        }
 
                        /* Wait for an ack */
@@ -2409,7 +2409,7 @@ static int _getsocks(char **args, char *payload, struct appctx *appctx, void *pr
 
                        if (ret <= 0) {
                                ha_warning("Unexpected error while transferring sockets\n");
-                               return -1;
+                               goto out;
                        }
                        curoff = 0;
                        nb_queued = 0;