From: Frederic Lecaille <flecaille@haproxy.com>
Date: Tue, 21 Jul 2026 13:09:20 +0000 (+0200)
Subject: BUG/MINOR: haload: fix use-after-free upon updating task expiration
X-Git-Url: http://git.ipfire.org/gitweb/?a=commitdiff_plain;h=38c790cac3ebf306bb743e119e99f7fbf5156f0d;p=thirdparty%2Fhaproxy.git

BUG/MINOR: haload: fix use-after-free upon updating task expiration

Fix a bug in hld_strm_task() where hs was accessed after it had already been
freed via hldstream_free(&hs). The task expiration update and queueing
now safely rely on <usr> rather than <hs->usr>.
---

diff --git a/src/haload.c b/src/haload.c
index 6057d7978..638acdba8 100644
--- a/src/haload.c
+++ b/src/haload.c
@@ -1290,8 +1290,8 @@ struct task *hld_strm_task(struct task *t, void *context, unsigned int state)
 		 * is also the stream with the oldest expiration time.
 		 */
 		first_hs = LIST_ELEM(usr->strms.n, struct hldstream *, list);
-		hs->usr->task->expire = first_hs->expire;
-		task_queue(hs->usr->task);
+		usr->task->expire = first_hs->expire;
+		task_queue(usr->task);
 	}
 
 	goto leave;