]> git.kaiwu.me - haproxy.git/commit
BUG/MEDIUM: http_ana: fix potential NULL deref in http_process_req_common()
authorAurelien DARRAGON <adarragon@haproxy.com>
Mon, 15 Sep 2025 07:22:19 +0000 (09:22 +0200)
committerAurelien DARRAGON <adarragon@haproxy.com>
Mon, 15 Sep 2025 08:28:59 +0000 (10:28 +0200)
commitbe417c1db25bdf59a5d288e1feda146df8cd4fb8
treee2d5fdcfcfcfaba0cfcd58a94b4b78907fa0474a
parentb582fd41c29e3e189bc8b2b79e689f1298a9ee04
BUG/MEDIUM: http_ana: fix potential NULL deref in http_process_req_common()

As reported by @kenballus in GH #3118, a potential NULL-deref was
introduced in 3da1d63 ("BUG/MEDIUM: http_ana: handle yield for "stats
http-request" evaluation")

Indeed, px->uri_auth may be NULL when stats directive is not involved in
the current proxy section.

The bug went unnoticed because it didn't seem to cause any side-effect
so far and valgrind didn't catch it. However ASAN did, so let's fix it
before it causes harm.

It should be backported with 3da1d63.
src/http_ana.c