From: Ramesh Adhikari <adhikari.resume@gmail.com>
Date: Thu, 30 Jul 2026 16:29:16 +0000 (+0530)
Subject: h3-proxy: fix NULL deref when non-:status header arrives before :status
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=decc6090851236ec6b09ce79433283867d4d9746;p=thirdparty%2Fcurl.git

h3-proxy: fix NULL deref when non-:status header arrives before :status

Closes #22449
---

diff --git a/lib/vquic/cf-ngtcp2-proxy.c b/lib/vquic/cf-ngtcp2-proxy.c
index ec6de93368..f5c967c5b1 100644
--- a/lib/vquic/cf-ngtcp2-proxy.c
+++ b/lib/vquic/cf-ngtcp2-proxy.c
@@ -431,6 +431,9 @@ static int cb_h3_proxy_recv_header(nghttp3_conn *conn, int64_t stream_id,
     pctx->tunnel.resp = resp;
   }
   else {
+    if(!pctx->tunnel.resp) {
+      return NGHTTP3_ERR_CALLBACK_FAILURE;
+    }
     /* store as an HTTP1-style header */
     CURL_TRC_CF(data, cf, "[%" PRId64 "] header: %.*s: %.*s", stream_id,
                 (int)h3name.len, h3name.base, (int)h3val.len, h3val.base);