Fix use-after-free in statefulhelper::submit() level-9 debug (#1859)

A debug statement in helper.cc dereferences a pointer which
might have been freed in helperStatefulDispatch.

Detected by Semgrep

diff --git a/src/helper.cc b/src/helper.cc
index 197cd8f16a2a721dba9df3d2fc2687185f8b79d4..34267335e37d56625dc37c2a6408e05a013547fd 100644 (file)
--- a/src/helper.cc
+++ b/src/helper.cc
@@ -681,14 +681,12 @@ statefulhelper::submit(const char *buf, HLPCB * callback, void *data, const Help
         helper_stateful_server *srv;
         if ((srv = StatefulGetFirstAvailable(this))) {
             reserveServer(srv);
-            helperStatefulDispatch(srv, r);
+            helperStatefulDispatch(srv, r); // may delete r
         } else
             StatefulEnqueue(this, r);
     }
 
-    debugs(84, DBG_DATA, "placeholder: '" << r->request.placeholder <<
-           "', " << Raw("buf", buf, (!buf?0:strlen(buf))));
-
+    // r may be dangling here
     syncQueueStats();
 }