BUG/MINOR: ssl: free curves, sigalgs and client_sigalgs in srv_parse_*()

When curves, sigalgs, or client-sigalgs are parsed on a server line,
the string allocated via strdup() was assigned directly to
newsrv->ssl_ctx without releasing any prior value.

If the server inherited these SSL settings from default-server via
srv_ssl_settings_cpy(), or if the keyword was specified multiple
times on the same server line, the previous string was overwritten
and leaked.

Free the previous pointers using ha_free() before assigning the new
strdup() value in srv_parse_curves(), srv_parse_sigalgs(), and
srv_parse_client_sigalgs().

This change should be backported to all supported branches.

diff --git a/src/cfgparse-ssl.c b/src/cfgparse-ssl.c
index d9d213b70893c4f38feecdf49bf4a0651ccf088c..9617945152b46410e7b9ad8c2dc78f12bd1c1b9b 100644 (file)
--- a/src/cfgparse-ssl.c
+++ b/src/cfgparse-ssl.c
@@ -1965,6 +1965,7 @@ static int srv_parse_client_sigalgs(char **args, int *cur_arg, struct proxy *px,
                memprintf(err, "'%s' : missing signature algorithm list", args[*cur_arg]);
                return ERR_ALERT | ERR_FATAL;
        }
+       ha_free(&newsrv->ssl_ctx.client_sigalgs);
        newsrv->ssl_ctx.client_sigalgs = strdup(arg);
        if (!newsrv->ssl_ctx.client_sigalgs) {
                memprintf(err, "out of memory");
@@ -2016,6 +2017,7 @@ static int srv_parse_curves(char **args, int *cur_arg, struct proxy *px, struct
                memprintf(err, "'%s' : missing curves list", args[*cur_arg]);
                return ERR_ALERT | ERR_FATAL;
        }
+       ha_free(&newsrv->ssl_ctx.curves);
        newsrv->ssl_ctx.curves = strdup(arg);
        if (!newsrv->ssl_ctx.curves) {
                memprintf(err, "out of memory");
@@ -2177,6 +2179,7 @@ static int srv_parse_sigalgs(char **args, int *cur_arg, struct proxy *px, struct
                memprintf(err, "'%s' : missing signature algorithm list", args[*cur_arg]);
                return ERR_ALERT | ERR_FATAL;
        }
+       ha_free(&newsrv->ssl_ctx.sigalgs);
        newsrv->ssl_ctx.sigalgs = strdup(arg);
        if (!newsrv->ssl_ctx.sigalgs) {
                memprintf(err, "out of memory");