BUG/MINOR: mux-spop: Fix null-pointer deref on SPOP stream allocation failure

When we try to allocate a new SPOP stream, if an error is encountered,
spop_strm_destroy() is called to released the eventually allocated
stream. But, it must only be called if a stream was allocated. If the
reported error is an SPOP stream allocation failure, we must just leave to
avoid null-pointer dereference.

This patch should fix point 1 of the issue #2993. It must be backported as
far as 3.1.

diff --git a/src/mux_spop.c b/src/mux_spop.c
index 064068517a25bf38008cb4c52a59a61b90a7c0e6..6baf2a2dca183169b384673a7eb22d52fb59e231 100644 (file)
--- a/src/mux_spop.c
+++ b/src/mux_spop.c
@@ -1260,7 +1260,8 @@ static struct spop_strm *spop_stconn_new(struct spop_conn *spop_conn, struct stc
 
   out:
        TRACE_DEVEL("leaving on error", SPOP_EV_SPOP_STRM_NEW|SPOP_EV_SPOP_STRM_END|SPOP_EV_SPOP_STRM_ERR, spop_conn->conn);
-       spop_strm_destroy(spop_strm);
+       if (spop_strm)
+               spop_strm_destroy(spop_strm);
        return NULL;
 }