From f2f3f0792dbd6a1b146069b2ec1f6703e695004e Mon Sep 17 00:00:00 2001 From: Christopher Faulet Date: Wed, 16 Sep 2026 09:13:30 +0200 Subject: [PATCH] BUG/MEDIUM: http-client: Don't use the httpclient context if it was released The I/O handler of the http-client applet may be called after the applet release. In this case, the httpclient context is no longer available and the I/O handler must not use it. It is properly handled at the beginning of the function. However, the code added at the end, on the "out" label, to stop the data reception is evaluated in all cases, including when the httpclient context is NULL. It leads to a NULL-pointer dereference. So, now, is tested first. This patch must be backported as far as 3.3 with commit b24260ec9 ("BUG/MEDIUM: http-client: Only consume input buffer when hc one is empty"). --- src/http_client.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/http_client.c b/src/http_client.c index 96d55ee80..d2b75309c 100644 --- a/src/http_client.c +++ b/src/http_client.c @@ -879,7 +879,7 @@ void httpclient_applet_io_handler(struct appctx *appctx) } out: - if (appctx->st0 != HTTPCLIENT_S_RES_END && !b_is_null(&hc->res.buf)) { + if (hc && appctx->st0 != HTTPCLIENT_S_RES_END && !b_is_null(&hc->res.buf)) { /* Don't accept more data while the httpclient response buffer is not empty */ applet_wont_consume(appctx); } -- 2.47.3