From: Willy Tarreau <w@1wt.eu>
Date: Tue, 15 Sep 2026 14:37:58 +0000 (+0200)
Subject: BUG/MINOR: cfgparse-global: add missing calloc() check for the global description
X-Git-Tag: v3.5-dev9~166
X-Git-Url: https://git.kaiwu.me/$%7BISSUES%7D/static/gitweb.js?a=commitdiff_plain;h=fa138a0c22cc3c7a2fcb051dec378e0a20bc4a46;p=haproxy.git

BUG/MINOR: cfgparse-global: add missing calloc() check for the global description

The global "description" keyword passes the result of calloc() directly to
snprintf() without checking it, resulting in a crash instead of an error
message if the allocation fails.

This may be backported to all supported versions.
---

diff --git a/src/cfgparse-global.c b/src/cfgparse-global.c
index 0e8624de0..1d2146692 100644
--- a/src/cfgparse-global.c
+++ b/src/cfgparse-global.c
@@ -471,6 +471,12 @@ int cfg_parse_global(const char *file, int linenum, char **args, int kwm)
 
 		free(global.desc);
 		global.desc = d = calloc(1, len);
+		if (!d) {
+			ha_alert("parsing [%s:%d]: cannot allocate memory for '%s'.\n",
+				 file, linenum, args[0]);
+			err_code |= ERR_ALERT | ERR_ABORT;
+			goto out;
+		}
 
 		d += snprintf(d, global.desc + len - d, "%s", args[1]);
 		for (i = 2; *args[i]; i++)