From eca4e38c59e47bdb192c21e8dee7b157ea8ccced Mon Sep 17 00:00:00 2001 From: Willy Tarreau Date: Fri, 14 Aug 2026 17:48:14 +0200 Subject: [PATCH] BUG/MINOR: uri-auth: never risk to dereference a NULL on error path The fix in commit 2dfbc311a8 ("BUG/MINOR: uri-auth: avoid leaks on initialization error") added *root = NULL, but the functions support being called with root == NULL, though nothing does it in the whole code. At least it triggers Coverity (see github issue #3476 and #3477). So let's fix it. No backport is needed since it cannot happen in the current code base. --- src/uri_auth.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/src/uri_auth.c b/src/uri_auth.c index db1d83dc5..448cd46c6 100644 --- a/src/uri_auth.c +++ b/src/uri_auth.c @@ -275,7 +275,8 @@ struct uri_auth *stats_add_auth(struct uri_auth **root, char *user) free(u->userlist); } free(u); - *root = NULL; + if (root) + *root = NULL; } return NULL; } @@ -320,7 +321,8 @@ struct uri_auth *stats_add_scope(struct uri_auth **root, char *scope) out_u: if (!old_u) { free(u); - *root = NULL; + if (root) + *root = NULL; } out: return NULL; -- 2.47.3