From: Frederic Lecaille <flecaille@haproxy.com>
Date: Wed, 12 Aug 2026 13:27:46 +0000 (+0200)
Subject: BUG/MINOR: h3: fix potential NULL pointer dereference in _h3_trace_header()
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=10ae6c2c75dd1e52c9ddf972a7b5d98a5242dab2;p=thirdparty%2Fhaproxy.git

BUG/MINOR: h3: fix potential NULL pointer dereference in _h3_trace_header()

This bug can be triggered only when the h3 traces are enabled.

It has been reported by coverity in GH #3469 where qcc was checked for NULL
earlier in _h3_trace_header(), then dereferenced without a check via qcc->conn
during the next TRACE_PRINTF_LOC() call.

This bug was introduced by this commit:

    BUG/MINOR: h3: adjust HTTP headers traces

and should be backported with it, if needed.
---

diff --git a/src/h3.c b/src/h3.c
index 394977470..16ce85a1f 100644
--- a/src/h3.c
+++ b/src/h3.c
@@ -671,7 +671,7 @@ static void _h3_trace_header(const struct ist n, const struct ist v,
 		chunk_appendf(&trash, " (... +%ld)", (long)(v.len - v_short.len));
 
 	TRACE_PRINTF_LOC(TRACE_LEVEL_USER, mask, trc_loc, func,
-	                 qcc->conn, qcs, 0, 0, "%s%s %s %s: %s", c_str, s_str,
+	                 qcc ? qcc->conn : NULL, qcs, 0, 0, "%s%s %s %s: %s", c_str, s_str,
 	                 mask & H3_EV_TX_HDR ? "sndh" : "rcvh",
 	                 istptr(n_short), istptr(v_short));
 }