From: Willy Tarreau <w@1wt.eu>
Date: Mon, 9 Nov 2026 16:49:11 +0000 (+0100)
Subject: CLEANUP: mux-h2: clarify that bptr is not NULL when calling to h2_get_buf()
X-Git-Url: https://git.kaiwu.me/?a=commitdiff_plain;h=2798a0a3a9e9b8e1266d3670cb5fea714d57348c;p=haproxy.git

CLEANUP: mux-h2: clarify that bptr is not NULL when calling to h2_get_buf()

In h2_frt_transfer_data(), we first check h2s_rxbuf_tail() and if it's
NULL, we get out. A bit later we pass that function's return to
h2_get_buf(), which dereferences it. It's OK since it was checked. But
depending on optimization levels and tiny extra fixes, gcc-9.5 (at least)
sometimes thinks it sees a possible null-deref and emits a warning. Let's
just use the known safe version of h2s_rxbuf_tail() since we know for sure
that the pointer is valid so that the compiler is no longer confused. A
comment was added at the top of the function to clarify that the pointer
may not be NULL.
---

diff --git a/src/mux_h2.c b/src/mux_h2.c
index 355ec837d..95984aa48 100644
--- a/src/mux_h2.c
+++ b/src/mux_h2.c
@@ -1296,6 +1296,7 @@ static int h2_buf_available(void *target)
 	return 0;
 }
 
+/* note that bptr may not be NULL here */
 static inline struct buffer *h2_get_buf(struct h2c *h2c, struct buffer *bptr)
 {
 	struct buffer *buf = NULL;
@@ -6640,7 +6641,7 @@ static int h2_frt_transfer_data(struct h2s *h2s)
 
  next_buffer:
 	/* now we have a non-full rxbuf */
-	scbuf = h2_get_buf(h2c, h2s_rxbuf_tail(h2s));
+	scbuf = h2_get_buf(h2c, _h2s_rxbuf_tail(h2s));
 	if (!scbuf) {
 		h2c->flags |= H2_CF_DEM_SALLOC;
 		TRACE_STATE("waiting for an h2s rxbuf", H2_EV_RX_FRAME|H2_EV_RX_DATA|H2_EV_H2S_BLK, h2c->conn, h2s);