From: Amaury Denoyelle <adenoyelle@haproxy.com>
Date: Fri, 4 Aug 2023 13:34:34 +0000 (+0200)
Subject: BUILD: quic: fix wrong potential NULL dereference
X-Git-Tag: v2.9-dev3~68
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=f40a72a7fffe5a926d8a01547fa19a686fe591b5;p=thirdparty%2Fhaproxy.git

BUILD: quic: fix wrong potential NULL dereference

GCC warns about a possible NULL dereference when requeuing a datagram on
the connection socket. This happens due to a MT_LIST_POP to retrieve a
rxbuf instance.

In fact, this can never be NULL there is enough rxbuf allocated for each
thread. Once a thread has finished to work with it, it must always
reappend it.

This issue was introduced with the following patch :
  commit b34d353968db7f646e83871cb6b21a246af84ddc
  BUG/MEDIUM: quic: consume contig space on requeue datagram
As such, it must be backported in every version with the above commit.

This should fix the github CI compilation error.
---

diff --git a/src/quic_sock.c b/src/quic_sock.c
index 88bcb1a31f..572a471bf8 100644
--- a/src/quic_sock.c
+++ b/src/quic_sock.c
@@ -739,6 +739,7 @@ int qc_rcv_buf(struct quic_conn *qc)
 			TRACE_STATE("datagram for other connection on quic-conn socket, requeue it", QUIC_EV_CONN_RCV, qc);
 
 			rxbuf = MT_LIST_POP(&l->rx.rxbuf_list, typeof(rxbuf), rxbuf_el);
+			ALREADY_CHECKED(rxbuf);
 			cspace = b_contig_space(&rxbuf->buf);
 
 			tmp_dgram = quic_rxbuf_purge_dgrams(rxbuf);