From: Christopher Faulet <cfaulet@haproxy.com>
Date: Wed, 16 Sep 2026 07:13:30 +0000 (+0200)
Subject: BUG/MEDIUM: http-client: Don't use the httpclient context if it was released
X-Git-Tag: v3.5-dev8~187
X-Git-Url: https://git.kaiwu.me/$%7BISSUES%7D/static/gitweb.js?a=commitdiff_plain;h=f2f3f0792dbd6a1b146069b2ec1f6703e695004e;p=haproxy.git

BUG/MEDIUM: http-client: Don't use the httpclient context if it was released

The I/O handler of the http-client applet may be called after the applet
release. In this case, the httpclient context is no longer available and the
I/O handler must not use it. It is properly handled at the beginning of the
function. However, the code added at the end, on the "out" label, to stop
the data reception is evaluated in all cases, including when the httpclient
context is NULL. It leads to a NULL-pointer dereference.

So, now, <hc> is tested first.

This patch must be backported as far as 3.3 with commit b24260ec9
("BUG/MEDIUM: http-client: Only consume input buffer when hc one is empty").
---

diff --git a/src/http_client.c b/src/http_client.c
index 96d55ee80..d2b75309c 100644
--- a/src/http_client.c
+++ b/src/http_client.c
@@ -879,7 +879,7 @@ void httpclient_applet_io_handler(struct appctx *appctx)
 	}
 
 out:
-	if (appctx->st0 != HTTPCLIENT_S_RES_END && !b_is_null(&hc->res.buf)) {
+	if (hc && appctx->st0 != HTTPCLIENT_S_RES_END && !b_is_null(&hc->res.buf)) {
 		/* Don't accept more data while the httpclient response buffer is not empty */
 		applet_wont_consume(appctx);
 	}