unlang/limit: fix NULL deref in signal handler when cancelling a dynamic limit argument

diff --git a/src/lib/unlang/limit.c b/src/lib/unlang/limit.c
index b715a702ef0052a76afee767462061130fc2bf3f..683069e37d7d3bd474056d28ebe9f54340cf14d6 100644 (file)
--- a/src/lib/unlang/limit.c
+++ b/src/lib/unlang/limit.c
@@ -50,9 +50,11 @@ static void unlang_limit_signal(UNUSED request_t *request, unlang_stack_frame_t
 {
        unlang_frame_state_limit_t      *state = talloc_get_type_abort(frame->state, unlang_frame_state_limit_t);
 
-       if (action == FR_SIGNAL_CANCEL) {
-               state->thread->active_callers--;
-       }
+       if (action != FR_SIGNAL_CANCEL) return;
+
+       if (!state->thread) return;
+
+       state->thread->active_callers--;
 }
 
 static unlang_action_t unlang_limit_resume_done(UNUSED unlang_result_t *p_result, UNUSED request_t *request, unlang_stack_frame_t *frame)