From: Amaury Denoyelle <adenoyelle@haproxy.com>
Date: Tue, 25 Nov 2025 14:07:51 +0000 (+0100)
Subject: BUG/MINOR: server: fix srv_drop() crash on partially init srv
X-Git-Tag: v3.3.0~10
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=a363b536a984b2fbc944a652a8b66f7c5bbc744e;p=thirdparty%2Fhaproxy.git

BUG/MINOR: server: fix srv_drop() crash on partially init srv

A recent patch has introduced free operation for QUIC tokens stored in a
server. These values are located in <per_thr> server array.

However, a server instance may be released prior to its full
initialization in case of a failure during "add server" CLI command. The
mentionned patch would cause a srv_drop() crash due to an invalid usage
of NULL <per_thr> member.

Fix this by adding a check on <per_thr> prior to dereference it in
srv_drop().

No need to backport.
---

diff --git a/src/server.c b/src/server.c
index f92449219..988a83fb0 100644
--- a/src/server.c
+++ b/src/server.c
@@ -3241,8 +3241,10 @@ struct server *srv_drop(struct server *srv)
 
 	free(srv->id);
 #ifdef USE_QUIC
-	for (i = 0; i < global.nbthread; i++)
-		istfree(&srv->per_thr[i].quic_retry_token);
+	if (srv->per_thr) {
+		for (i = 0; i < global.nbthread; i++)
+			istfree(&srv->per_thr[i].quic_retry_token);
+	}
 #endif
 	srv_free_params(srv);