From: Adam Crawford <adamcrawford253@gmail.com>
Date: Thu, 5 Nov 2026 23:32:47 +0000 (-0600)
Subject: BUG/MEDIUM: filters: avoid NULL block access in decompression
X-Git-Url: https://git.kaiwu.me/?a=commitdiff_plain;h=2e2de896c361e3be61233d19e9d7c8246bdc2645;p=haproxy.git

BUG/MEDIUM: filters: avoid NULL block access in decompression

The decompression filter may end up with a NULL block pointer when
processing an empty request. If no replacement block is provided,
htx_get_next_blk() is called with this NULL pointer, causing HAProxy
to crash.

Only advance to the next block if the current block pointer is valid.

This was introduced 3.5-dev, no backport needed.
---

diff --git a/src/flt_decomp.c b/src/flt_decomp.c
index b0409342a..670095845 100644
--- a/src/flt_decomp.c
+++ b/src/flt_decomp.c
@@ -363,7 +363,7 @@ static int decomp_stream_blk(struct stream *s, struct filter *f, struct channel
 
 		if (next)
 			blk = next; // next override requested
-		else
+		else if (blk)
 			blk = htx_get_next_blk(htx, blk);
 		offset = 0;
 	}