BUG/MINOR: h3: fix potential NULL pointer dereference in _h3_trace_header()

This bug can be triggered only when the h3 traces are enabled.

It has been reported by coverity in GH #3469 where qcc was checked for NULL
earlier in _h3_trace_header(), then dereferenced without a check via qcc->conn
during the next TRACE_PRINTF_LOC() call.

This bug was introduced by this commit:

    BUG/MINOR: h3: adjust HTTP headers traces

and should be backported with it, if needed.

diff --git a/src/h3.c b/src/h3.c
index 394977470de6601b72a6f2f815a9e1ef4e3b8f83..16ce85a1fbd02f47d5a94bf31c0b41121e50b4bb 100644 (file)
--- a/src/h3.c
+++ b/src/h3.c
@@ -671,7 +671,7 @@ static void _h3_trace_header(const struct ist n, const struct ist v,
                chunk_appendf(&trash, " (... +%ld)", (long)(v.len - v_short.len));
 
        TRACE_PRINTF_LOC(TRACE_LEVEL_USER, mask, trc_loc, func,
-                        qcc->conn, qcs, 0, 0, "%s%s %s %s: %s", c_str, s_str,
+                        qcc ? qcc->conn : NULL, qcs, 0, 0, "%s%s %s %s: %s", c_str, s_str,
                         mask & H3_EV_TX_HDR ? "sndh" : "rcvh",
                         istptr(n_short), istptr(v_short));
 }