From: Willy Tarreau <w@1wt.eu>
Date: Fri, 14 Aug 2026 15:56:44 +0000 (+0200)
Subject: BUG/MINOR: mux-h2: harden h2_dump_h2s_info() against potentially null h2s->sd
X-Git-Tag: v3.5-dev5~30
X-Git-Url: https://git.kaiwu.me/?a=commitdiff_plain;h=2abd47127c40c7ebf62ea4aca2e2cc13b36a75e4;p=haproxy.git

BUG/MINOR: mux-h2: harden h2_dump_h2s_info() against potentially null h2s->sd

Not really sure if this can happen but since the code already takes care
of testing the sd, better make sure everywhere it's dereferenced it's
tested. And h2s_sc() does dereference h2s->sd which is later tested in
that function.

Under normal circumstances it's fine (when called from the stream via
h2_show_fd()) but it's less certain when dumping FDs via h2_show_fd()
which is called by the CLI's "show fd" debugging command. Let's just
guard all h2s_sc() under an sd test then.

Thanks to Ilya for reporting this Coverity finding in GH issue #3475.

This can be backported wherever it applies.
---

diff --git a/src/mux_h2.c b/src/mux_h2.c
index 937d5f4db..7704de822 100644
--- a/src/mux_h2.c
+++ b/src/mux_h2.c
@@ -8534,10 +8534,13 @@ static int h2_dump_h2s_info(struct buffer *msg, const struct h2s *h2s, const cha
 	if (pfx)
 		chunk_appendf(msg, "\n%s", pfx);
 
-	chunk_appendf(msg, " .sc=%p", h2s_sc(h2s));
-	if (h2s_sc(h2s))
-		chunk_appendf(msg, "(.flg=0x%08x .app=%p)",
-			      h2s_sc(h2s)->flags, h2s_sc(h2s)->app);
+	if (h2s->sd) {
+		/* h2s_sc requires an sd! */
+		chunk_appendf(msg, " .sc=%p", h2s_sc(h2s));
+		if (h2s_sc(h2s))
+			chunk_appendf(msg, "(.flg=0x%08x .app=%p)",
+				      h2s_sc(h2s)->flags, h2s_sc(h2s)->app);
+	}
 
 	chunk_appendf(msg, " .sd=%p", h2s->sd);
 	if (h2s->sd)