From: Frederic Lecaille <flecaille@haproxy.com>
Date: Wed, 26 Aug 2026 11:57:00 +0000 (+0200)
Subject: BUG/MINOR: haload: fix hld_new_usr()'s error path
X-Git-Tag: v3.5-dev6~62
X-Git-Url: https://git.kaiwu.me/?a=commitdiff_plain;h=409b7924390c7be5b67d7e0736b32be578ae5e5d;p=haproxy.git

BUG/MINOR: haload: fix hld_new_usr()'s error path

When <usr>, <t>, or <sess> failed to allocate, the error path always
dereferenced ->urls, even when <usr> itself hadn't been allocated
yet. It also never freed <sess> on any failure, leaking it.

<usr> is now only allocated once <t> and <sess> are confirmed valid,
so ->urls is only ever touched once <usr> is fully set up. The error
path frees <sess> too, on every failure.
---

diff --git a/src/haload.c b/src/haload.c
index 763b54046..42095d1cd 100644
--- a/src/haload.c
+++ b/src/haload.c
@@ -2087,12 +2087,17 @@ static inline struct hld_usr *hld_new_usr(int nreqs, int tid)
 	struct session *sess;
 
 	BUG_ON(!nreqs);
-	usr = malloc(sizeof(*usr));
 	t = task_new_on(tid);
 	sess = session_new(&hld_proxy, NULL, NULL);
-	if (!usr || !t || !sess) {
+	if (!t || !sess) {
 		ha_alert("could not allocate a new user\n");
-		goto err;
+		goto err_deps;
+	}
+
+	usr = malloc(sizeof(*usr));
+	if (!usr) {
+		ha_alert("could not allocate a new user\n");
+		goto err_deps;
 	}
 
 	t->process = hld_usr_task;
@@ -2146,8 +2151,12 @@ static inline struct hld_usr *hld_new_usr(int nreqs, int tid)
 		free(url);
 		url = next_url;
 	}
-	task_destroy(t);
 	free(usr);
+
+ err_deps:
+	if (sess)
+		session_free(sess);
+	task_destroy(t);
 	return NULL;
 }