mirror of
http://git.haproxy.org/git/haproxy.git
synced 2026-02-10 07:22:41 +02:00
In the function fas_srv_reposition(), the server's lb_tree is tested from outside the lock. So it is possible to remove it after the test and then call eb32_insert() in fas_queue_srv() with a NULL root pointer, which is invalid. Moving the test in the scope of the lock fixes the bug. This issue was reported on Github, issue #126. This patch must be backported to 2.0, 1.9 and 1.8.