From: Christopher Faulet Date: Wed, 21 Oct 2026 09:25:01 +0000 (+0000) Subject: BUG/MINOR: cache: skip already resolved filters when resolving caches X-Git-Url: https://git.kaiwu.me/ngx_http_access_module.html?a=commitdiff_plain;h=2f8db919ff413ab15066e48a65c02fdf996fbbda;p=haproxy.git BUG/MINOR: cache: skip already resolved filters when resolving caches This is a latent bug with no visible impact today: when a proxy uses several caches, resolving the second cache's name reads the first cache's structure as if it were a string. post_check_cache() resolves the caches one after the other, and for each of them walks the cache filter configurations of all the proxies with cache_postcheck_flt(), which compares the cache's name with cconf->c.name. But c is a union: once a configuration is resolved, CACHE_FLT_INIT is set and c.cache points to the cache, whose structure is then compared as a string with the name of the next cache. This currently reads the first bytes of the cache's first tree root, which are NULL at boot, so it never matches, but any change to the layout of struct cache or to the moment this runs could make it match or read past the structure. The configurations already resolved, i.e. flagged with CACHE_FLT_INIT, are now skipped. This patch may be backported. If so, it must be adapted because this part was reworked on 3.5. --- diff --git a/src/cache.c b/src/cache.c index 21d34c001..da9245cee 100644 --- a/src/cache.c +++ b/src/cache.c @@ -3256,6 +3256,9 @@ static int cache_postcheck_flt(struct flt_conf *fconf, void *data) if (fconf->id != cache_store_flt_id) return 0; cconf = fconf->conf; + /* already resolved: c.name now holds a struct cache pointer */ + if (cconf->flags & CACHE_FLT_INIT) + return 0; if (strcmp(cache->id, cconf->c.name) != 0) return 0; free(cconf->c.name);