From: Christopher Faulet <cfaulet@haproxy.com>
Date: Tue, 29 Sep 2026 08:54:36 +0000 (+0200)
Subject: BUG/MINOR: resolvers: fix leaks on do-resolve's fetch availability error
X-Git-Url: https://git.kaiwu.me/?a=commitdiff_plain;h=88181a0849f1cc22554ec7947e9947ee1f128a46;p=haproxy.git

BUG/MINOR: resolvers: fix leaks on do-resolve's fetch availability error

When the sample fetch used by a do-resolve rule is not available in the
rule's context (e.g. "res.hdr(x)" in an http-request rule),
resolv_parse_do_resolve() releases the sample expression with free()
instead of release_sample_expr(), leaking its arguments and converters,
and returns without releasing the variable name, resolvers id and
options it already allocated, contrary to the other error paths.

This only happens on configuration errors, after which the process
exits, but it's visible with valgrind:

    backend b
        http-request do-resolve(txn.ip,r) res.hdr(x)

reports 349 bytes definitely lost in 4 blocks before this fix, 0 after.

While this patch may be backported to all stable version, it is harmless.
So no reason to backport it.
---

diff --git a/src/resolvers.c b/src/resolvers.c
index ccfc2582e..25139c39e 100644
--- a/src/resolvers.c
+++ b/src/resolvers.c
@@ -3543,7 +3543,10 @@ enum act_parse_ret resolv_parse_do_resolve(const char **args, int *orig_arg, str
 		memprintf(err,
 			  "fetch method '%s' extracts information from '%s', none of which is available here",
 			  args[cur_arg-1], sample_src_names(expr->fetch->use));
-		free(expr);
+		release_sample_expr(expr);
+		ha_free(&rule->arg.resolv.varname);
+		ha_free(&rule->arg.resolv.resolvers_id);
+		ha_free(&rule->arg.resolv.opts);
 		return ACT_RET_PRS_ERR;
 	}
 	rule->arg.resolv.expr = expr;