Re: segfault writing to log from Lua

[Michael Ezzell]

Although I am seeing this in Lua, it does not appear (to me) to a the fault
in the Lua code... recent changes in __send_log() in log.c appear to assume
p is never null (there's a test for this condition earlier, then p is
referenced later), and that is not valid behavior in this case, because
there is no proxy associated:

(gdb) run
Starting program: /home/ubuntu/haproxy-1.6-dev6/haproxy -f ./haproxy.cfg

Program received signal SIGSEGV, Segmentation fault.
__send_log (p=p@entry=0x0, level=level@entry=1, message=<optimized out>,
size=10,
    sd=sd@entry=0x711160 <default_rfc5424_sd_log_format> "- ",
sd_size=sd_size@entry=2) at src/log.c:1025
1025                    if (unlikely(htp->len >= maxlen)) {
(gdb) print htp->len
Cannot access memory at address 0xda4
(gdb) print htp
$1 = (struct chunk *) 0xd98
(gdb) print &p->log_htp
$2 = (struct chunk *) 0xd98
(gdb) print p
$3 = (struct proxy *) 0x0
(gdb)

This minimal test case can be replicated with the following two files:

$ cat haproxy.cfg

global
        log 127.0.0.1 local0
        lua-load crash.lua
        user haproxy
        group nogroup
        daemon

defaults
        log     global

$ cat crash.lua

core.Alert("hello.lua");