From: William Lallemand <wlallemand@haproxy.com>
Date: Tue, 18 Aug 2026 14:41:20 +0000 (+0000)
Subject: BUG/MINOR: haproxy: fix out-of-scope tmpdir usage in do_chroot()
X-Git-Tag: v3.5-dev5~13
X-Git-Url: https://git.kaiwu.me/?a=commitdiff_plain;h=b39eb58ec706fb119a1aecc53f22b4581a399241;p=haproxy.git

BUG/MINOR: haproxy: fix out-of-scope tmpdir usage in do_chroot()

Coverity (CID 1660133, GH #3470) reports that dir may point to the
block-local tmpdir[] array after it has gone out of scope, since dir
is read again in the "Cannot chroot()" alert past the end of the
"chroot auto" if-block. Move tmpdir's declaration to function scope
so its lifetime covers every use of dir.

Must be backported to 3.4.
---

diff --git a/src/haproxy.c b/src/haproxy.c
index 801bc6dfe..8b9bb6637 100644
--- a/src/haproxy.c
+++ b/src/haproxy.c
@@ -3372,6 +3372,7 @@ static int do_chroot(const char *prog, const char *path)
 {
 	const char *dir, *chroot_dir;
 	int error, chroot_error;
+	char tmpdir[] = "/tmp/haproxy.XXXXXX";
 
 	error = chroot_error = 0;
 	dir = chroot_dir = path;
@@ -3379,7 +3380,6 @@ static int do_chroot(const char *prog, const char *path)
 		/* When "chroot auto" is used, we attempt to chroot to an
 		 * anonymous and read-only directory.
 		 */
-		char tmpdir[] = "/tmp/haproxy.XXXXXX";
 		dir = mkdtemp(tmpdir);
 		if (dir == NULL) {
 			ha_alert("[%s.main()] Cannot create(%s) for chroot auto.\n",