From ff403602edc917b8bef2062dc0d5dec2017e3232 Mon Sep 17 00:00:00 2001
From: Willy Tarreau <w@1wt.eu>
Date: Fri, 21 Oct 2016 17:14:35 +0200
Subject: [PATCH 08/26] BUG/MINOR: vars: make smp_fetch_var() more robust
 against misuses

smp_fetch_var() may be called from everywhere since it just reads a
variable. It must ensure that the stream exists before trying to return
a stream-dependant variable. For now there is no impact but it will
cause trouble with tcp-request session rules.
(cherry picked from commit 7513d001c8a6b7d1cf8e7d5469942cd39d6e8160)
---
 src/vars.c | 16 +++++++++++++---
 1 file changed, 13 insertions(+), 3 deletions(-)

diff --git a/src/vars.c b/src/vars.c
index b22c3bf..4a0c4ed 100644
--- a/src/vars.c
+++ b/src/vars.c
@@ -242,11 +242,21 @@ static int smp_fetch_var(const struct arg *args, struct sample *smp, const char
 
 	/* Check the availibity of the variable. */
 	switch (var_desc->scope) {
-	case SCOPE_SESS: vars = &smp->sess->vars;  break;
-	case SCOPE_TXN:  vars = &smp->strm->vars_txn;    break;
+	case SCOPE_SESS:
+		vars = &smp->sess->vars;
+		break;
+	case SCOPE_TXN:
+		if (!smp->strm)
+			return 0;
+		vars = &smp->strm->vars_txn;
+		break;
 	case SCOPE_REQ:
 	case SCOPE_RES:
-	default:         vars = &smp->strm->vars_reqres; break;
+	default:
+		if (!smp->strm)
+			return 0;
+		vars = &smp->strm->vars_reqres;
+		break;
 	}
 	if (vars->scope != var_desc->scope)
 		return 0;
-- 
2.7.3

