From a363b536a984b2fbc944a652a8b66f7c5bbc744e Mon Sep 17 00:00:00 2001 From: Amaury Denoyelle Date: Tue, 25 Nov 2025 15:07:51 +0100 Subject: [PATCH] BUG/MINOR: server: fix srv_drop() crash on partially init srv A recent patch has introduced free operation for QUIC tokens stored in a server. These values are located in server array. However, a server instance may be released prior to its full initialization in case of a failure during "add server" CLI command. The mentionned patch would cause a srv_drop() crash due to an invalid usage of NULL member. Fix this by adding a check on prior to dereference it in srv_drop(). No need to backport. --- src/server.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/src/server.c b/src/server.c index f92449219..988a83fb0 100644 --- a/src/server.c +++ b/src/server.c @@ -3241,8 +3241,10 @@ struct server *srv_drop(struct server *srv) free(srv->id); #ifdef USE_QUIC - for (i = 0; i < global.nbthread; i++) - istfree(&srv->per_thr[i].quic_retry_token); + if (srv->per_thr) { + for (i = 0; i < global.nbthread; i++) + istfree(&srv->per_thr[i].quic_retry_token); + } #endif srv_free_params(srv);