In h2_frt_transfer_data(), we first check h2s_rxbuf_tail() and if it's
NULL, we get out. A bit later we pass that function's return to
h2_get_buf(), which dereferences it. It's OK since it was checked. But
depending on optimization levels and tiny extra fixes, gcc-9.5 (at least)
sometimes thinks it sees a possible null-deref and emits a warning. Let's
just use the known safe version of h2s_rxbuf_tail() since we know for sure
that the pointer is valid so that the compiler is no longer confused. A
comment was added at the top of the function to clarify that the pointer
may not be NULL.
return 0;
}
+/* note that bptr may not be NULL here */
static inline struct buffer *h2_get_buf(struct h2c *h2c, struct buffer *bptr)
{
struct buffer *buf = NULL;
next_buffer:
/* now we have a non-full rxbuf */
- scbuf = h2_get_buf(h2c, h2s_rxbuf_tail(h2s));
+ scbuf = h2_get_buf(h2c, _h2s_rxbuf_tail(h2s));
if (!scbuf) {
h2c->flags |= H2_CF_DEM_SALLOC;
TRACE_STATE("waiting for an h2s rxbuf", H2_EV_RX_FRAME|H2_EV_RX_DATA|H2_EV_H2S_BLK, h2c->conn, h2s);