From 38c790cac3ebf306bb743e119e99f7fbf5156f0d Mon Sep 17 00:00:00 2001 From: Frederic Lecaille Date: Tue, 21 Jul 2026 15:09:20 +0200 Subject: [PATCH] BUG/MINOR: haload: fix use-after-free upon updating task expiration Fix a bug in hld_strm_task() where hs was accessed after it had already been freed via hldstream_free(&hs). The task expiration update and queueing now safely rely on rather than usr>. --- src/haload.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/haload.c b/src/haload.c index 6057d7978..638acdba8 100644 --- a/src/haload.c +++ b/src/haload.c @@ -1290,8 +1290,8 @@ struct task *hld_strm_task(struct task *t, void *context, unsigned int state) * is also the stream with the oldest expiration time. */ first_hs = LIST_ELEM(usr->strms.n, struct hldstream *, list); - hs->usr->task->expire = first_hs->expire; - task_queue(hs->usr->task); + usr->task->expire = first_hs->expire; + task_queue(usr->task); } goto leave; -- 2.47.3