]> git.ipfire.org Git - thirdparty/haproxy.git/commitdiff
BUG/MINOR: hq_interop: fix potential NULL dereference in _hq_trace_http()
authorFrederic Lecaille <flecaille@haproxy.com>
Wed, 12 Aug 2026 13:44:08 +0000 (15:44 +0200)
committerFrederic Lecaille <flecaille@haproxy.com>
Wed, 12 Aug 2026 13:51:40 +0000 (15:51 +0200)
This bug can be triggered only if the hq_interop traces are enabled. It
has been reported by GH #3468.

In _hq_trace_http(), qcs->qcc->conn was directly passed to TRACE_PRINTF_LOC.
However, qcs can be NULL, leading to a crash.

Fix this by using the <qcc> parameter passed to the function instead,
with a NULL check.

No need to backport.

src/hq_interop.c

index 4d2b4a80f042c393339a1b5e9927efa582cf6fff..5ba90cfacf352b0227baba2513ca7e0a3ecf4e0e 100644 (file)
@@ -447,7 +447,7 @@ static void _hq_trace_http(const char *line, uint64_t mask,
                chunk_appendf(&trash, " qcs=%p(%llu)", qcs, (ullong)qcs->id);
 
        TRACE_PRINTF_LOC(TRACE_LEVEL_USER, mask, trc_loc, func,
-                        qcs->qcc->conn, qcs, 0, 0,
+                        qcc ? qcc->conn : NULL, qcs, 0, 0,
                         "%s%s %s %s", c_str, s_str,
                         mask & QMUX_EV_STRM_SEND ? "sndh" : "rcvh", line);
 }