BUG/MINOR: ssl: Fix possible null deref on the SSL context in ssl_sock_to_buf()

In ssl_sock_to_buf(), before exiting, the SSL context was systematically
dereferenced to clear SSL_SOCK_F_KTLS_RX_CTRL flag. However, at the
beginning, the SSL context is tested. So theorically, it seems possible to
enter with a NULL SSL context. So to avoid any NULL dereference, the SSL
context is now tested before clearing SSL_SOCK_F_KTLS_RX_CTRL flag

This patch should solve the issue #3465. It should be backported as far as
3.3.

diff --git a/src/ssl_sock.c b/src/ssl_sock.c
index 772062f3f0b8d88e2d960798479356148174d6c0..aa5f0f0ee084312898043ec40c48ceba38a7f641 100644 (file)
--- a/src/ssl_sock.c
+++ b/src/ssl_sock.c
@@ -7676,7 +7676,8 @@ static size_t ssl_sock_to_buf(struct connection *conn, void *xprt_ctx, struct bu
                }
        }
  leave:
-       ctx->flags &= ~SSL_SOCK_F_KTLS_RX_CTRL;
+       if (ctx)
+               ctx->flags &= ~SSL_SOCK_F_KTLS_RX_CTRL;
        TRACE_LEAVE(SSL_EV_CONN_RECV, conn);
        return done;