From 7df91b76349b1a2668d51b12b94fab5365b0de25 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Ond=C5=99ej=20Sur=C3=BD?= Date: Mon, 15 Jun 2026 18:09:37 +0200 Subject: [PATCH] Guard against a detached stream in isc__nm_http_request() error path On a submit failure, client_send() nullifies sock->h2->connect.cstream and frees the stream before returning the error. The error: label in isc__nm_http_request() reloaded that pointer and dereferenced it unconditionally, reading through a NULL stream. The function is only used by the DoH unit tests -- production DoH client send goes through isc__nm_http_send()/client_httpsend(), whose submit failure is reported via the NULL-safe send callback -- so this is a latent defect in the test helper rather than a reachable named crash. Skip the read callback when the stream has already been detached and let the caller report the failure from the error result it receives. Assisted-by: Claude:claude-opus-4-8 --- lib/isc/netmgr/http.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/lib/isc/netmgr/http.c b/lib/isc/netmgr/http.c index 94f38485d8..8f6cf2104d 100644 --- a/lib/isc/netmgr/http.c +++ b/lib/isc/netmgr/http.c @@ -2097,8 +2097,15 @@ isc__nm_http_request(isc_nmhandle_t *handle, isc_region_t *region, return ISC_R_SUCCESS; error: + /* + * client_send() detaches and frees the stream on a submit failure + * (it nullifies sock->h2->connect.cstream before submitting, then + * frees it on the failure branch), so the reloaded pointer can be + * NULL here. The caller still gets the error result and reports the + * failure itself. + */ cstream = sock->h2->connect.cstream; - if (cstream->read_cb != NULL) { + if (cstream != NULL && cstream->read_cb != NULL) { cstream->read_cb(handle, result, NULL, cstream->read_cbarg); } return result;