From: Christopher Faulet Date: Tue, 29 Sep 2026 07:29:21 +0000 (+0200) Subject: BUG/MINOR: resolvers: Always init a new resolution's list element X-Git-Url: https://git.kaiwu.me/?a=commitdiff_plain;h=77be1f07882289b98b24a709298d87153a026928;p=haproxy.git BUG/MINOR: resolvers: Always init a new resolution's list element resolv_pick_resolution() allocates a new resolution with pool_zalloc(), then duplicates the hostname into it. If strdup() fails, the resolution is released with resolv_free_resolution(), which ends with LIST_DEL_INIT(&resolution->list). But this list element was not initialized yet (it's only appended to the wait list once the hostname was duplicated), so it contains NULL pointers which are dereferenced, crashing the process instead of reporting the allocation failure. This can only happen when running out of memory. Let's initialize the list element with the other fields. This was introduced in 3.3 by commit 6cf2401ed ("BUG/MEDIUM: resolvers: Make resolution owns its hostname_dn value"), so this must be backported wherever this commit was backported (so as far as 2.8). --- diff --git a/src/resolvers.c b/src/resolvers.c index a3091b95d..feca18e59 100644 --- a/src/resolvers.c +++ b/src/resolvers.c @@ -2060,6 +2060,7 @@ static struct resolv_resolution *resolv_pick_resolution(struct resolvers *resolv res->last_valid = now_ms; LIST_INIT(&res->requesters); + LIST_INIT(&res->list); res->response.answer_tree = EB_ROOT; res->response.next = NULL;