From: Alexander Bainbridge-Sedivy <alex.bainbridge@inkbridge.io>
Date: Wed, 22 Jul 2026 14:34:20 +0000 (-0400)
Subject: unlang/limit: fix NULL deref in signal handler when cancelling a dynamic limit argument
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=968797bbbfa64968d6bcdf8a825b65203695b95e;p=thirdparty%2Ffreeradius-server.git

unlang/limit: fix NULL deref in signal handler when cancelling a dynamic limit argument
---

diff --git a/src/lib/unlang/limit.c b/src/lib/unlang/limit.c
index b715a702ef0..683069e37d7 100644
--- a/src/lib/unlang/limit.c
+++ b/src/lib/unlang/limit.c
@@ -50,9 +50,11 @@ static void unlang_limit_signal(UNUSED request_t *request, unlang_stack_frame_t
 {
 	unlang_frame_state_limit_t	*state = talloc_get_type_abort(frame->state, unlang_frame_state_limit_t);
 
-	if (action == FR_SIGNAL_CANCEL) {
-		state->thread->active_callers--;
-	}
+	if (action != FR_SIGNAL_CANCEL) return;
+
+	if (!state->thread) return;
+
+	state->thread->active_callers--;
 }
 
 static unlang_action_t unlang_limit_resume_done(UNUSED unlang_result_t *p_result, UNUSED request_t *request, unlang_stack_frame_t *frame)