From 2abd47127c40c7ebf62ea4aca2e2cc13b36a75e4 Mon Sep 17 00:00:00 2001 From: Willy Tarreau Date: Fri, 14 Aug 2026 17:56:44 +0200 Subject: [PATCH] BUG/MINOR: mux-h2: harden h2_dump_h2s_info() against potentially null h2s->sd Not really sure if this can happen but since the code already takes care of testing the sd, better make sure everywhere it's dereferenced it's tested. And h2s_sc() does dereference h2s->sd which is later tested in that function. Under normal circumstances it's fine (when called from the stream via h2_show_fd()) but it's less certain when dumping FDs via h2_show_fd() which is called by the CLI's "show fd" debugging command. Let's just guard all h2s_sc() under an sd test then. Thanks to Ilya for reporting this Coverity finding in GH issue #3475. This can be backported wherever it applies. --- src/mux_h2.c | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) diff --git a/src/mux_h2.c b/src/mux_h2.c index 937d5f4db..7704de822 100644 --- a/src/mux_h2.c +++ b/src/mux_h2.c @@ -8534,10 +8534,13 @@ static int h2_dump_h2s_info(struct buffer *msg, const struct h2s *h2s, const cha if (pfx) chunk_appendf(msg, "\n%s", pfx); - chunk_appendf(msg, " .sc=%p", h2s_sc(h2s)); - if (h2s_sc(h2s)) - chunk_appendf(msg, "(.flg=0x%08x .app=%p)", - h2s_sc(h2s)->flags, h2s_sc(h2s)->app); + if (h2s->sd) { + /* h2s_sc requires an sd! */ + chunk_appendf(msg, " .sc=%p", h2s_sc(h2s)); + if (h2s_sc(h2s)) + chunk_appendf(msg, "(.flg=0x%08x .app=%p)", + h2s_sc(h2s)->flags, h2s_sc(h2s)->app); + } chunk_appendf(msg, " .sd=%p", h2s->sd); if (h2s->sd) -- 2.47.3