From: Martin Mirchev <mirchevmartin2203@gmail.com>
Date: Wed, 28 Oct 2026 14:08:10 +0000 (+0800)
Subject: BUG/MINOR: server: free the sample expression when it is not usable on a server
X-Git-Tag: v3.5-dev10~4
X-Git-Url: https://git.kaiwu.me/?a=commitdiff_plain;h=8c84ab5621f52112ccd9a704cfd023faf595e469;p=haproxy.git

BUG/MINOR: server: free the sample expression when it is not usable on a server

parse_srv_expr() parses the "sni" and "pool-conn-name" expressions of a
server. When the fetch cannot be used on a server connection (e.g. a
fetch that needs a response such as "res.hdr(host)"), it reports an error
and returns without releasing the expression it has just allocated.

At startup this is harmless since the process exits on the error, but the
same function is used by the "add server" CLI command. Each rejected
"add server ... sni <expr>" leaks the expression (about 200 bytes per
command, as reported by valgrind), so a script or an operator repeatedly
issuing such commands slowly increases the process' memory usage. Only
admin-level CLI users can trigger it.

This fixes GitHub issue #3547.

This must be backported to all stable versions starting with 3.0, where
the code was introduced by commit 91001422b4 ("MINOR: server: generalize
sni expr parsing").
---

diff --git a/src/server.c b/src/server.c
index 4775e4186..50c7771ce 100644
--- a/src/server.c
+++ b/src/server.c
@@ -2677,6 +2677,7 @@ static int parse_srv_expr(char *str, struct sample_expr **out, struct proxy *px,
 		memprintf(err, "fetch method '%s' extracts information from '%s', "
 		          "none of which is available here.",
 		          str, sample_src_names(expr->fetch->use));
+		release_sample_expr(expr);
 		return ERR_ALERT | ERR_FATAL;
 	}