upstream/haproxy
1
0
Fork 0
mirror of https://github.com/haproxy/haproxy.git synced 2026-04-13 21:06:13 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions 12

BUG/MINOR: mux-quic: fix potential NULL deref on qcc_release()

Browse source 
In qcc_release(), <conn> may be NULL. Thus every access on it must be
tested.

With recent QMux introduction, a call to conn_is_quic() has been added
prior to registration of the stream rejection callback. It could lead to
NULL deref as <conn> is not tested there. Fix this by adding an extra
check on the pointer validity.

No need to backport.
This commit is contained in:
Amaury Denoyelle 2026-04-08 14:58:08 +02:00
parent 4ad200f276
commit 90d0e8a948
1 changed files with 1 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
src/mux_quic.c
View file

@ -3463,7 +3463,7 @@ static void qcc_release(struct qcc *qcc)
if (qcc->app_ops) {
if (qcc->app_ops->release)
qcc->app_ops->release(qcc->ctx);
if (conn_is_quic(conn) && conn->handle.qc)
if (conn && conn_is_quic(conn) && conn->handle.qc)
conn->handle.qc->strm_reject = qcc->app_ops->strm_reject;
}
TRACE_PROTO("application layer released", QMUX_EV_QCC_END, conn);