mirrors/haproxy
1
0
Fork 0
mirror of https://git.haproxy.org/git/haproxy.git/ synced 2026-05-02 03:30:59 +02:00
Code Issues Projects Releases Wiki Activity

BUG/MINOR: sample: fix NULL strm dereference in sample_conv_when

Browse Source 
Several cases in sample_conv_when (FORWARDED, TOAPPLET, PROCESSED, ACL)
access smp->strm->scb without checking if strm is NULL. The strm field
may be NULL (e.g., tcp-request connection). Let's add NULL checks to
prevent dereferencing a NULL pointer.

This should be backported to 3.1.
This commit is contained in:
Willy Tarreau 2026-04-26 23:56:00 +02:00
parent 7465b5ec38
commit 25c8d7b094
1 changed files with 4 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
src/sample.c
View File

@ -4028,20 +4028,20 @@ static int sample_conv_when(const struct arg *arg_p, struct sample *smp, void *p
break;
case WHEN_COND_FORWARDED: // true if forwarded to a connection
ret = !!sc_conn(smp->strm->scb);
ret = strm && !!sc_conn(strm->scb);
break;
case WHEN_COND_TOAPPLET: // true if handled as an applet
ret = !!sc_appctx(smp->strm->scb);
ret = strm && !!sc_appctx(strm->scb);
break;
case WHEN_COND_PROCESSED: // true if forwarded or appctx
ret = sc_conn(smp->strm->scb) || sc_appctx(smp->strm->scb);
ret = strm && (sc_conn(strm->scb) || sc_appctx(strm->scb));
break;
case WHEN_COND_ACL: // true if the ACL pointed to by args[2] evaluates to true
acl_sample = arg_p[2].data.ptr;
ret = acl_exec_cond(&acl_sample->cond, smp->px, smp->sess, smp->strm, smp->opt) == ACL_TEST_PASS;
ret = acl_exec_cond(&acl_sample->cond, smp->px, smp->sess, strm, smp->opt) == ACL_TEST_PASS;
break;
}