The decompression filter may end up with a NULL block pointer when
processing an empty request. If no replacement block is provided,
htx_get_next_blk() is called with this NULL pointer, causing HAProxy
to crash.
Only advance to the next block if the current block pointer is valid.
This was introduced 3.5-dev, no backport needed.
---
src/flt_decomp.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/src/flt_decomp.c b/src/flt_decomp.c
index b0409342a..670095845 100644
--- a/src/flt_decomp.c
+++ b/src/flt_decomp.c
@@ -363,7 +363,7 @@ static int decomp_stream_blk(struct stream *s, struct
filter *f, struct channel
if (next)
blk = next; // next override requested
- else
+ else if (blk)
blk = htx_get_next_blk(htx, blk);
offset = 0;
}
--
2.55.0
