From: Kirill Furman <kir.furman@gmail.com>
Date: Fri, 14 Aug 2026 13:10:02 +0000 (+0300)
Subject: BUG/MINOR: log: fix double-free error when error in parse_loger occurs
X-Git-Tag: v3.5-dev5~32
X-Git-Url: https://git.kaiwu.me/?a=commitdiff_plain;h=9204caf5452120de41d57bae0430b5240d63d4a9;p=haproxy.git

BUG/MINOR: log: fix double-free error when error in parse_loger occurs

Passing incorrect argments in parse_logger() which contains sample and
some values, value of logger->lb.smp_rgs will equal to smp_rgs and then,
if goto error: occurs we firstly free(smp_rgs) and after it
free(logger->lb.smp_rgs) inside free_logger() function causes double-free.
It has been reported in GH #3458

Fix it by checking the value of logger->lb.smp_rgs inside error:
statement in parse_logger(), if it equal to smp_rgs - just assign
NULL to logger->lb.smp_rgs.

This fix should be backported to versions 2.6 and upper.
---

diff --git a/src/log.c b/src/log.c
index c21c21926..240ff2eec 100644
--- a/src/log.c
+++ b/src/log.c
@@ -1966,6 +1966,8 @@ int parse_logger(char **args, struct list *loggers, int do_del, const char *file
 
   error:
 	free(smp_rgs);
+	if (logger && logger->lb.smp_rgs == smp_rgs)
+		logger->lb.smp_rgs = NULL;
 	free_logger(logger);
 	return 0;
 }