From: Frederic Lecaille <flecaille@haproxy.com>
Date: Wed, 12 Aug 2026 13:44:08 +0000 (+0200)
Subject: BUG/MINOR: hq_interop: fix potential NULL dereference in _hq_trace_http()
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=0378631eeb57a308333d1f29a8635a78ee9ca753;p=thirdparty%2Fhaproxy.git

BUG/MINOR: hq_interop: fix potential NULL dereference in _hq_trace_http()

This bug can be triggered only if the hq_interop traces are enabled. It
has been reported by GH #3468.

In _hq_trace_http(), qcs->qcc->conn was directly passed to TRACE_PRINTF_LOC.
However, qcs can be NULL, leading to a crash.

Fix this by using the <qcc> parameter passed to the function instead,
with a NULL check.

No need to backport.
---

diff --git a/src/hq_interop.c b/src/hq_interop.c
index 4d2b4a80f..5ba90cfac 100644
--- a/src/hq_interop.c
+++ b/src/hq_interop.c
@@ -447,7 +447,7 @@ static void _hq_trace_http(const char *line, uint64_t mask,
 		chunk_appendf(&trash, " qcs=%p(%llu)", qcs, (ullong)qcs->id);
 
 	TRACE_PRINTF_LOC(TRACE_LEVEL_USER, mask, trc_loc, func,
-	                 qcs->qcc->conn, qcs, 0, 0,
+	                 qcc ? qcc->conn : NULL, qcs, 0, 0,
 	                 "%s%s %s %s", c_str, s_str,
 	                 mask & QMUX_EV_STRM_SEND ? "sndh" : "rcvh", line);
 }