From: Christopher Faulet <cfaulet@haproxy.com>
Date: Wed, 4 Sep 2019 08:22:34 +0000 (+0200)
Subject: BUG/MINOR: mux-h1: Fix a possible null pointer dereference in h1_subscribe()
X-Git-Tag: v2.1-dev2~113
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=51bb1856181b2d8897cfc5694cca7d2a3241cb33;p=thirdparty%2Fhaproxy.git

BUG/MINOR: mux-h1: Fix a possible null pointer dereference in h1_subscribe()

This patch fixes the github issue #243. No backport needed.
---

diff --git a/src/mux_h1.c b/src/mux_h1.c
index 647a44f8f1..e6383305b0 100644
--- a/src/mux_h1.c
+++ b/src/mux_h1.c
@@ -2382,7 +2382,7 @@ static int h1_subscribe(struct conn_stream *cs, int event_type, void *param)
 {
 	struct wait_event *sw;
 	struct h1s *h1s = cs->ctx;
-	struct h1c *h1c = h1s->h1c;
+	struct h1c *h1c;
 
 	if (!h1s)
 		return -1;
@@ -2405,6 +2405,7 @@ static int h1_subscribe(struct conn_stream *cs, int event_type, void *param)
 			 * probably means the connection wasn't established
 			 * yet, so we have to subscribe.
 			 */
+			h1c = h1s->h1c;
 			if (!(h1c->wait_event.events & SUB_RETRY_SEND))
 				h1c->conn->xprt->subscribe(h1c->conn,
 				                           h1c->conn->xprt_ctx,