From 9ab8039d06ad2d1a3d20558372c7a8a91189f0bd Mon Sep 17 00:00:00 2001 From: Christopher Faulet Date: Wed, 7 Oct 2026 11:00:48 +0200 Subject: [PATCH] BUG/MINOR: mux-h1: don't dereference a NULL opposite sedesc in h1_fastfwd() In h1_fastfwd(), when the opposite stream endpoint descriptor cannot be retrieved, the function jumps to the "out" label, which unconditionally dereferences (iobuf flags and se_done_ff()), leading to a NULL pointer dereference. It is probably not reachable today, because fast-forwarding is only attempted when the opposite endpoint announced it can consume fast-forwarded data, which implies both sides are linked. But the error path is wrong anyway. Now the fast-forwarding is aborted in this case, like when nothing can be done, so that the regular receive path is used instead. This patch may be backported as far as 3.0 if needed. --- src/mux_h1.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/src/mux_h1.c b/src/mux_h1.c index e24fd26f1..c38d9ad19 100644 --- a/src/mux_h1.c +++ b/src/mux_h1.c @@ -5346,8 +5346,10 @@ static int h1_fastfwd(struct stconn *sc, unsigned int count, unsigned int flags) sdo = h1s_opposite_sd(h1s); if (!sdo) { + /* Note: is dereferenced in the "out" path */ + h1c->flags &= ~H1C_F_WANT_FASTFWD; TRACE_STATE("Opposite endpoint not available yet", H1_EV_STRM_RECV, h1c->conn, h1s); - goto out; + goto end; } retry: -- 2.47.3