BUG/MEDIUM: filters: avoid NULL block access in decompression

The decompression filter may end up with a NULL block pointer when
processing an empty request. If no replacement block is provided,
htx_get_next_blk() is called with this NULL pointer, causing HAProxy
to crash.

Only advance to the next block if the current block pointer is valid.

This was introduced 3.5-dev, no backport needed.

diff --git a/src/flt_decomp.c b/src/flt_decomp.c
index b0409342a8bd5b2c6998ff18077539388d9225f4..670095845d9f797daff0adf14501af85badddfcc 100644 (file)
--- a/src/flt_decomp.c
+++ b/src/flt_decomp.c
@@ -363,7 +363,7 @@ static int decomp_stream_blk(struct stream *s, struct filter *f, struct channel
 
                if (next)
                        blk = next; // next override requested
-               else
+               else if (blk)
                        blk = htx_get_next_blk(htx, blk);
                offset = 0;
        }