Author: Finn Thain <fthain@telegraphics.com.au>

Bug 2332: segfault in tunnelConnectTimeout()

Fixes at least one race condition.

If tunnelConnectTimeout() is called before tunnelPeerSelectComplete(), then
tunnelState->servers will be NULL.

diff --git a/src/tunnel.cc b/src/tunnel.cc
index da4fdcb6d82d47cc51937b13e20b4193b1e04d4e..741585d3657f22968521b2a72142e271115eddfd 100644 (file)
--- a/src/tunnel.cc
+++ b/src/tunnel.cc
@@ -465,16 +465,18 @@ tunnelConnectTimeout(int fd, void *data)
     HttpRequest *request = tunnelState->request;
     ErrorState *err = NULL;
 
-    if (tunnelState->servers->_peer)
-        hierarchyNote(&tunnelState->request->hier, tunnelState->servers->code,
-                      tunnelState->servers->_peer->host);
-    else if (Config.onoff.log_ip_on_direct)
-        hierarchyNote(&tunnelState->request->hier, tunnelState->servers->code,
-                      fd_table[tunnelState->server.fd()].ipaddr);
-    else
-        hierarchyNote(&tunnelState->request->hier, tunnelState->servers->code,
-                      tunnelState->host);
-
+    if (tunnelState->servers) {
+        if (tunnelState->servers->_peer)
+            hierarchyNote(&tunnelState->request->hier, tunnelState->servers->code,
+                          tunnelState->servers->_peer->host);
+        else if (Config.onoff.log_ip_on_direct)
+            hierarchyNote(&tunnelState->request->hier, tunnelState->servers->code,
+                          fd_table[tunnelState->server.fd()].ipaddr);
+        else
+            hierarchyNote(&tunnelState->request->hier, tunnelState->servers->code,
+                          tunnelState->host);
+    } else
+       debugs(26, 1, "tunnelConnectTimeout(): tunnelState->servers is NULL");
 
     err = errorCon(ERR_CONNECT_FAIL, HTTP_SERVICE_UNAVAILABLE, request);