From: Christopher Faulet <cfaulet@haproxy.com>
Date: Mon, 21 Sep 2026 06:25:49 +0000 (+0200)
Subject: BUG/MINOR: ssl: Fix possible null deref on the SSL context in ssl_sock_to_buf()
X-Git-Tag: v3.5-dev8~136
X-Git-Url: https://git.kaiwu.me/?a=commitdiff_plain;h=a39562d6e9c3b1d20c57392eb4b66be9bc089652;p=haproxy.git

BUG/MINOR: ssl: Fix possible null deref on the SSL context in ssl_sock_to_buf()

In ssl_sock_to_buf(), before exiting, the SSL context was systematically
dereferenced to clear SSL_SOCK_F_KTLS_RX_CTRL flag. However, at the
beginning, the SSL context is tested. So theorically, it seems possible to
enter with a NULL SSL context. So to avoid any NULL dereference, the SSL
context is now tested before clearing SSL_SOCK_F_KTLS_RX_CTRL flag

This patch should solve the issue #3465. It should be backported as far as
3.3.
---

diff --git a/src/ssl_sock.c b/src/ssl_sock.c
index 772062f3f..aa5f0f0ee 100644
--- a/src/ssl_sock.c
+++ b/src/ssl_sock.c
@@ -7676,7 +7676,8 @@ static size_t ssl_sock_to_buf(struct connection *conn, void *xprt_ctx, struct bu
 		}
 	}
  leave:
-	ctx->flags &= ~SSL_SOCK_F_KTLS_RX_CTRL;
+	if (ctx)
+		ctx->flags &= ~SSL_SOCK_F_KTLS_RX_CTRL;
 	TRACE_LEAVE(SSL_EV_CONN_RECV, conn);
 	return done;