From: Christopher Faulet Date: Wed, 7 Oct 2026 09:00:48 +0000 (+0200) Subject: BUG/MINOR: mux-h1: don't dereference a NULL opposite sedesc in h1_fastfwd() X-Git-Tag: v3.5-dev10~150 X-Git-Url: https://git.kaiwu.me/$%7BISSUES%7D/static/gitweb.js?a=commitdiff_plain;h=9ab8039d06ad2d1a3d20558372c7a8a91189f0bd;p=haproxy.git BUG/MINOR: mux-h1: don't dereference a NULL opposite sedesc in h1_fastfwd() In h1_fastfwd(), when the opposite stream endpoint descriptor cannot be retrieved, the function jumps to the "out" label, which unconditionally dereferences (iobuf flags and se_done_ff()), leading to a NULL pointer dereference. It is probably not reachable today, because fast-forwarding is only attempted when the opposite endpoint announced it can consume fast-forwarded data, which implies both sides are linked. But the error path is wrong anyway. Now the fast-forwarding is aborted in this case, like when nothing can be done, so that the regular receive path is used instead. This patch may be backported as far as 3.0 if needed. --- diff --git a/src/mux_h1.c b/src/mux_h1.c index e24fd26f1..c38d9ad19 100644 --- a/src/mux_h1.c +++ b/src/mux_h1.c @@ -5346,8 +5346,10 @@ static int h1_fastfwd(struct stconn *sc, unsigned int count, unsigned int flags) sdo = h1s_opposite_sd(h1s); if (!sdo) { + /* Note: is dereferenced in the "out" path */ + h1c->flags &= ~H1C_F_WANT_FASTFWD; TRACE_STATE("Opposite endpoint not available yet", H1_EV_STRM_RECV, h1c->conn, h1s); - goto out; + goto end; } retry: