A segfault may occur when a peer is parsed while the peers section is invalid,
for example because the peers section name was forgotten in the configuration
file.

Example :
  peers
    peer LB1 127.0.0.1:1234
    peer LB2 127.0.0.1:1235

The parser saves a static pointer on the current section parsed, we should set
it to NULL when a parsing error is detected and prevent to initialize the peer
when it appears.
---
 src/cfgparse.c | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/src/cfgparse.c b/src/cfgparse.c
index 88231f9..19beda6 100644
--- a/src/cfgparse.c
+++ b/src/cfgparse.c
@@ -1542,6 +1542,7 @@ int cfg_parse_peers(const char *file, int linenum, char 
**args, int kwm)
 
        if (strcmp(args[0], "peers") == 0) { /* new peers section */
                if (!*args[1]) {
+                       curpeers = NULL;
                        Alert("parsing [%s:%d] : missing name for peers 
section.\n", file, linenum);
                        err_code |= ERR_ALERT | ERR_FATAL;
                        goto out;
@@ -1549,6 +1550,7 @@ int cfg_parse_peers(const char *file, int linenum, char 
**args, int kwm)
 
                err = invalid_char(args[1]);
                if (err) {
+                       curpeers = NULL;
                        Alert("parsing [%s:%d] : character '%c' is not 
permitted in '%s' name '%s'.\n",
                              file, linenum, *err, args[0], args[1]);
                        err_code |= ERR_ALERT | ERR_FATAL;
@@ -1600,6 +1602,13 @@ int cfg_parse_peers(const char *file, int linenum, char 
**args, int kwm)
                        goto out;
                }
 
+               if (!curpeers) {
+                       Alert("parsing [%s:%d] : no peers section declared or 
the last one was invalid.\n",
+                             file, linenum);
+                       err_code |= ERR_ALERT | ERR_FATAL;
+                       goto out;
+               }
+
                if ((newpeer = (struct peer *)calloc(1, sizeof(struct peer))) 
== NULL) {
                        Alert("parsing [%s:%d] : out of memory.\n", file, 
linenum);
                        err_code |= ERR_ALERT | ERR_ABORT;
-- 
1.9.rc1


Reply via email to