[CRITICAL] potential NULL dereference when counting stats in dispatch mode

diff --git a/haproxy.c b/haproxy.c
index 254afc057bab53779aa442670a9c6d82a6f7bab8..cc2be57c738e094d556dbf1123f0e692e53b8587 100644 (file)
--- a/haproxy.c
+++ b/haproxy.c
@@ -5398,7 +5398,8 @@ int process_srv(struct session *t) {
                    tv_eternity(&t->srexpire);
                
                t->srv_state = SV_STDATA;
-               t->srv->cum_sess++;
+               if (t->srv)
+                   t->srv->cum_sess++;
                rep->rlim = rep->data + BUFSIZE; /* no rewrite needed */
 
                /* if the user wants to log as soon as possible, without counting
@@ -5410,7 +5411,8 @@ int process_srv(struct session *t) {
            }
            else {
                t->srv_state = SV_STHEADERS;
-               t->srv->cum_sess++;
+               if (t->srv)
+                   t->srv->cum_sess++;
                rep->rlim = rep->data + BUFSIZE - MAXREWRITE; /* rewrite needed */
            }
            tv_eternity(&t->cnexpire);