[audit][httpsm] Unconditional _ua.get_txn() dereference in server response header parse (null for SCHEDULED_UPDATE/REVPROXY)

Severity: medium · Category: logic-bug
Location: src/proxy/http/HttpSM.cc:2211

What's wrong

In state_read_server_response_header(), the ParseResult::DONE branch unconditionally does _ua.get_txn()->set_inactivity_timeout(...). The very same function guards this pointer earlier (line 2106: if (_ua.get_txn() && _ua.get_txn()->has_request_body(...))), and setup_server_read_response_header() — which installs this handler — explicitly asserts that _ua.get_txn() may be null for HttpRequestFlavor_t::SCHEDULED_UPDATE / REVPROXY (line 7096-7097). Reaching DONE on such a flavor dereferences a null user-agent transaction. This is an internal-request/scheduled-update path, so exposure is limited, but the guard inconsistency within one function makes it a real latent null-deref.

Evidence

line 2106: if (_ua.get_txn() && _ua.get_txn()->has_request_body(...))   // guarded
line 2211: _ua.get_txn()->set_inactivity_timeout(HRTIME_SECONDS(t_state.txn_conf->transaction_no_activity_timeout_in));   // unguarded
// setup_server_read_response_header assert (7096):
ink_assert(_ua.get_txn() != nullptr || t_state.req_flavor == HttpTransact::HttpRequestFlavor_t::SCHEDULED_UPDATE || t_state.req_flavor == HttpTransact::HttpRequestFlavor_t::REVPROXY);

Suggested fix

Guard the set_inactivity_timeout with if (_ua.get_txn()), matching the guard already present at line 2106 and the null-tolerance documented in setup_server_read_response_header().

Filed from an automated multi-lens codebase audit. Full report: CODEBASE_AUDIT.md / audit-report.html on branch claude/codebase-audit-review-9nw7vz.

Start in src/proxy/http/HttpSM.cc at state_read_server_response_header(), then read setup_server_read_response_header() around lines 7096-7097 and the existing guard around line 2106. Confirm the DONE path is safe for SCHEDULED_UPDATE and REVPROXY and verify that inactivity-timeout handling remains correct for normal transactions.