BUG/MINOR: cache: skip already resolved filters when resolving caches

This is a latent bug with no visible impact today: when a proxy uses
several caches, resolving the second cache's name reads the first cache's
structure as if it were a string.

post_check_cache() resolves the caches one after the other, and for each
of them walks the cache filter configurations of all the proxies with
cache_postcheck_flt(), which compares the cache's name with cconf->c.name.
But c is a union: once a configuration is resolved, CACHE_FLT_INIT is set
and c.cache points to the cache, whose structure is then compared as a
string with the name of the next cache. This currently reads the first
bytes of the cache's first tree root, which are NULL at boot, so it never
matches, but any change to the layout of struct cache or to the moment
this runs could make it match or read past the structure.

The configurations already resolved, i.e. flagged with CACHE_FLT_INIT, are
now skipped.

This patch may be backported. If so, it must be adapted because this part
was reworked on 3.5.

diff --git a/src/cache.c b/src/cache.c
index 21d34c001e6e083dd4d7da89be8f58b256708fa6..da9245cee36667679a614f17922df628fcf74ba5 100644 (file)
--- a/src/cache.c
+++ b/src/cache.c
@@ -3256,6 +3256,9 @@ static int cache_postcheck_flt(struct flt_conf *fconf, void *data)
        if (fconf->id != cache_store_flt_id)
                return 0;
        cconf = fconf->conf;
+       /* already resolved: c.name now holds a struct cache pointer */
+       if (cconf->flags & CACHE_FLT_INIT)
+               return 0;
        if (strcmp(cache->id, cconf->c.name) != 0)
                return 0;
        free(cconf->c.name);