From 15012177aa4537c641f5b0a07ef6c757b2265e26 Mon Sep 17 00:00:00 2001
From: Vladimir Dubrovin <3proxy@3proxy.ru>
Date: Sun, 8 Nov 2026 14:39:32 +0300
Subject: [PATCH] pcre: a rule with no ACL a match data of its own, not itself

A rule whose ACL was missing was handed to the filters as the
connection's data, which they read as a match data block and freed:
a pointer into the configuration, dereferenced as another type and
given back to malloc. A rule without an ACL now skips the check and
goes on with a block of its own, and nothing a filter is given is
ever the rule itself.

(cherry picked from commit a7e5a8b48bea8e19a112534ca30d86e99b57d918)
---
 src/pcre.c | 13 +++++++------
 1 file changed, 7 insertions(+), 6 deletions(-)

diff --git a/src/pcre.c b/src/pcre.c
index 3a700c9..e77094f 100644
--- a/src/pcre.c
+++ b/src/pcre.c
@@ -264,13 +264,14 @@ static FILTER_ACTION pcre_filter_client(void *fo, struct clientparam * param, vo
 	struct pcre_filter_data *rule = (struct pcre_filter_data *)fo;
 	struct pcre_client_data *pcd;
 
-	*fc = fo;
+	*fc = NULL;
 	if(!fo) return PASS;
-	if(!rule->acl) return CONTINUE;
-	memset (&tmpace, 0, sizeof(struct ace));
-	tmpace.src = rule->acl->src;
-	res = pl->ACLMatches(&tmpace, param);
-	if(!res) return PASS;
+	if(rule->acl){
+		memset (&tmpace, 0, sizeof(struct ace));
+		tmpace.src = rule->acl->src;
+		res = pl->ACLMatches(&tmpace, param);
+		if(!res) return PASS;
+	}
 	/* the connection goes on with a match data of its own */
 	if(!(pcd = pl->mallocfunc(sizeof(struct pcre_client_data)))){
 		*fc = NULL;