From: William Lallemand <wlallemand@irq6.net>
Date: Sun, 27 Sep 2026 19:02:22 +0000 (+0000)
Subject: BUG/MINOR: ssl: free curves, sigalgs and client_sigalgs in srv_parse_*()
X-Git-Tag: v3.5-dev8~109
X-Git-Url: https://git.kaiwu.me/?a=commitdiff_plain;h=cd6c78247ee99f9f513d848fc1476b6bbb31f72f;p=haproxy.git

BUG/MINOR: ssl: free curves, sigalgs and client_sigalgs in srv_parse_*()

When curves, sigalgs, or client-sigalgs are parsed on a server line,
the string allocated via strdup() was assigned directly to
newsrv->ssl_ctx without releasing any prior value.

If the server inherited these SSL settings from default-server via
srv_ssl_settings_cpy(), or if the keyword was specified multiple
times on the same server line, the previous string was overwritten
and leaked.

Free the previous pointers using ha_free() before assigning the new
strdup() value in srv_parse_curves(), srv_parse_sigalgs(), and
srv_parse_client_sigalgs().

This change should be backported to all supported branches.
---

diff --git a/src/cfgparse-ssl.c b/src/cfgparse-ssl.c
index d9d213b70..961794515 100644
--- a/src/cfgparse-ssl.c
+++ b/src/cfgparse-ssl.c
@@ -1965,6 +1965,7 @@ static int srv_parse_client_sigalgs(char **args, int *cur_arg, struct proxy *px,
 		memprintf(err, "'%s' : missing signature algorithm list", args[*cur_arg]);
 		return ERR_ALERT | ERR_FATAL;
 	}
+	ha_free(&newsrv->ssl_ctx.client_sigalgs);
 	newsrv->ssl_ctx.client_sigalgs = strdup(arg);
 	if (!newsrv->ssl_ctx.client_sigalgs) {
 		memprintf(err, "out of memory");
@@ -2016,6 +2017,7 @@ static int srv_parse_curves(char **args, int *cur_arg, struct proxy *px, struct
 		memprintf(err, "'%s' : missing curves list", args[*cur_arg]);
 		return ERR_ALERT | ERR_FATAL;
 	}
+	ha_free(&newsrv->ssl_ctx.curves);
 	newsrv->ssl_ctx.curves = strdup(arg);
 	if (!newsrv->ssl_ctx.curves) {
 		memprintf(err, "out of memory");
@@ -2177,6 +2179,7 @@ static int srv_parse_sigalgs(char **args, int *cur_arg, struct proxy *px, struct
 		memprintf(err, "'%s' : missing signature algorithm list", args[*cur_arg]);
 		return ERR_ALERT | ERR_FATAL;
 	}
+	ha_free(&newsrv->ssl_ctx.sigalgs);
 	newsrv->ssl_ctx.sigalgs = strdup(arg);
 	if (!newsrv->ssl_ctx.sigalgs) {
 		memprintf(err, "out of memory");