From: Willy Tarreau <w@1wt.eu>
Date: Fri, 21 Oct 2016 15:14:35 +0000 (+0200)
Subject: BUG/MINOR: vars: make smp_fetch_var() more robust against misuses
X-Git-Tag: v1.7-dev5~24
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=7513d001c8a6b7d1cf8e7d5469942cd39d6e8160;p=thirdparty%2Fhaproxy.git

BUG/MINOR: vars: make smp_fetch_var() more robust against misuses

smp_fetch_var() may be called from everywhere since it just reads a
variable. It must ensure that the stream exists before trying to return
a stream-dependant variable. For now there is no impact but it will
cause trouble with tcp-request session rules.
---

diff --git a/src/vars.c b/src/vars.c
index b22c3bf2ab..4a0c4ed350 100644
--- a/src/vars.c
+++ b/src/vars.c
@@ -242,11 +242,21 @@ static int smp_fetch_var(const struct arg *args, struct sample *smp, const char
 
 	/* Check the availibity of the variable. */
 	switch (var_desc->scope) {
-	case SCOPE_SESS: vars = &smp->sess->vars;  break;
-	case SCOPE_TXN:  vars = &smp->strm->vars_txn;    break;
+	case SCOPE_SESS:
+		vars = &smp->sess->vars;
+		break;
+	case SCOPE_TXN:
+		if (!smp->strm)
+			return 0;
+		vars = &smp->strm->vars_txn;
+		break;
 	case SCOPE_REQ:
 	case SCOPE_RES:
-	default:         vars = &smp->strm->vars_reqres; break;
+	default:
+		if (!smp->strm)
+			return 0;
+		vars = &smp->strm->vars_reqres;
+		break;
 	}
 	if (vars->scope != var_desc->scope)
 		return 0;