Hi, Here is the patch for GitHub issue #3547, as Amaury asked there, against current master (869308906). It is attached (git format-patch).
parse_srv_expr() returns an error without releasing the expression when the fetch cannot be used on a server, e.g. "sni res.hdr(host)". At startup the process exits anyway, but "add server" on the CLI goes through the same path, so each rejected command leaks the expression. The patch adds the missing release_sample_expr(). Tested on 869308906 with an ASan build (USE_OPENSSL=1) and five rejected "add server be/sN https://www.google.com/url?q=http://127.0.0.1:443&source=gmail&ust=1793282920041000&sa=E ssl verify none sni res.hdr(host)" commands: without the patch LeakSanitizer reports 985 bytes leaked in 15 allocations, from parse_srv_expr(); with it, no leak. The code is there since 3.0 (91001422b4). The issue was found with a static analysis engine (Infer/Pulse) and verified manually. Martin Mirchev
From a98598c368ba0160223f5df0235dac861b485452 Mon Sep 17 00:00:00 2001 From: Martin Mirchev <[email protected]> Date: Wed, 28 Oct 2026 22:08:10 +0800 Subject: [PATCH] BUG/MINOR: server: free the sample expression when it is not usable on a server parse_srv_expr() parses the "sni" and "pool-conn-name" expressions of a server. When the fetch cannot be used on a server connection (e.g. a fetch that needs a response such as "res.hdr(host)"), it reports an error and returns without releasing the expression it has just allocated. At startup this is harmless since the process exits on the error, but the same function is used by the "add server" CLI command. Each rejected "add server ... sni <expr>" leaks the expression (about 200 bytes per command, as reported by valgrind), so a script or an operator repeatedly issuing such commands slowly increases the process' memory usage. Only admin-level CLI users can trigger it. This fixes GitHub issue #3547. This must be backported to all stable versions starting with 3.0, where the code was introduced by commit 91001422b4 ("MINOR: server: generalize sni expr parsing"). --- src/server.c | 1 + 1 file changed, 1 insertion(+) diff --git a/src/server.c b/src/server.c index 4775e4186..50c7771ce 100644 --- a/src/server.c +++ b/src/server.c @@ -2677,6 +2677,7 @@ static int parse_srv_expr(char *str, struct sample_expr **out, struct proxy *px, memprintf(err, "fetch method '%s' extracts information from '%s', " "none of which is available here.", str, sample_src_names(expr->fetch->use)); + release_sample_expr(expr); return ERR_ALERT | ERR_FATAL; } -- 2.50.1
