From: William Lallemand <wlallemand@irq6.net>
Date: Sun, 27 Sep 2026 15:17:58 +0000 (+0000)
Subject: BUG/MINOR: ssl: copy curves, sigalgs and client_sigalgs in srv_ssl_settings_cpy()
X-Git-Tag: v3.5-dev8~111
X-Git-Url: https://git.kaiwu.me/?a=commitdiff_plain;h=f9cc8a3fea6484ee375d36782ad7b5a391f3d408;p=haproxy.git

BUG/MINOR: ssl: copy curves, sigalgs and client_sigalgs in srv_ssl_settings_cpy()

When a server inherits SSL settings from default-server, the curves,
sigalgs and client_sigalgs fields were not copied despite being
allocated by ssl-default-server-* keywords. This causes use-after-free
when the original ssl_ctx is destroyed while another reference still
holds the pointer.

Add strdup() calls guarded by the same OpenSSL API version checks
used elsewhere in the copy function.

Fixes issue #3506.

This change is should be backported to all supported branches.
---

diff --git a/src/server.c b/src/server.c
index f8fa20cb8..8cd97b978 100644
--- a/src/server.c
+++ b/src/server.c
@@ -2777,6 +2777,18 @@ static void srv_ssl_settings_cpy(struct server *srv, const struct server *src)
 		srv->ssl_ctx.verify_host = strdup(src->ssl_ctx.verify_host);
 	if (src->ssl_ctx.ciphers != NULL)
 		srv->ssl_ctx.ciphers = strdup(src->ssl_ctx.ciphers);
+#if defined(SSL_CTX_set1_curves_list)
+	if (src->ssl_ctx.curves != NULL)
+		srv->ssl_ctx.curves = strdup(src->ssl_ctx.curves);
+#endif
+#if defined(SSL_CTX_set1_sigalgs_list)
+	if (src->ssl_ctx.sigalgs != NULL)
+		srv->ssl_ctx.sigalgs = strdup(src->ssl_ctx.sigalgs);
+#endif
+#if defined(SSL_CTX_set1_client_sigalgs_list)
+	if (src->ssl_ctx.client_sigalgs != NULL)
+		srv->ssl_ctx.client_sigalgs = strdup(src->ssl_ctx.client_sigalgs);
+#endif
 	if (src->ssl_ctx.options)
 		srv->ssl_ctx.options = src->ssl_ctx.options;
 	if (src->ssl_ctx.methods.flags)