BUG/MINOR: haload: fix hld_new_usr()'s error path

When <usr>, <t>, or <sess> failed to allocate, the error path always
dereferenced ->urls, even when <usr> itself hadn't been allocated
yet. It also never freed <sess> on any failure, leaking it.

<usr> is now only allocated once <t> and <sess> are confirmed valid,
so ->urls is only ever touched once <usr> is fully set up. The error
path frees <sess> too, on every failure.

diff --git a/src/haload.c b/src/haload.c
index 763b540461064d01747d2b78c81212eb5670a1a7..42095d1cd913003cbb2782c07e61704ecd9ddb03 100644 (file)
--- a/src/haload.c
+++ b/src/haload.c
@@ -2087,12 +2087,17 @@ static inline struct hld_usr *hld_new_usr(int nreqs, int tid)
        struct session *sess;
 
        BUG_ON(!nreqs);
-       usr = malloc(sizeof(*usr));
        t = task_new_on(tid);
        sess = session_new(&hld_proxy, NULL, NULL);
-       if (!usr || !t || !sess) {
+       if (!t || !sess) {
                ha_alert("could not allocate a new user\n");
-               goto err;
+               goto err_deps;
+       }
+
+       usr = malloc(sizeof(*usr));
+       if (!usr) {
+               ha_alert("could not allocate a new user\n");
+               goto err_deps;
        }
 
        t->process = hld_usr_task;
@@ -2146,8 +2151,12 @@ static inline struct hld_usr *hld_new_usr(int nreqs, int tid)
                free(url);
                url = next_url;
        }
-       task_destroy(t);
        free(usr);
+
+ err_deps:
+       if (sess)
+               session_free(sess);
+       task_destroy(t);
        return NULL;
 }