[10.2][http] Unguarded server_txn->get_netvc()->lerrno null-deref on origin error paths

Branch: 10.2.x (10.2.1, commit 31f1f2f3b) · Severity: medium
Location: src/proxy/http/HttpSM.cc:6454, :6328, :4163

What's wrong

In handle_server_setup_error (VC_EVENT_ERROR), handle_post_failure, and tunnel_handler_post_server (VC_EVENT_ERROR), the code dereferences server_txn->get_netvc()->lerrno with no null check. ProxyTransaction::get_netvc() returns (_proxy_ssn) ? _proxy_ssn->get_netvc() : nullptr and can legitimately be null once the server side has been torn down on an error/abort path — exactly these paths — giving a null dereference and crash.

Fix

Fetch the netvc into a local and fall back to a sentinel errno when it is null:

NetVConnection *nvc = server_txn->get_netvc();
t_state.set_connect_fail(nvc ? nvc->lerrno : ECONNABORTED);

PR attached.

Testing

Compiles cleanly on 10.2.x (libhttp.a builds). clang-format clean.

From an automated multi-lens audit of the 10.2.x branch. Full report on branch claude/codebase-audit-review-9nw7vz (CODEBASE_AUDIT_10.2.md).

Start in src/proxy/http/HttpSM.cc at handle_server_setup_error, handle_post_failure, and tunnel_handler_post_server, using the stated line locations. Verify the three origin-error paths handle a missing server netvc without dereferencing it, then build libhttp.a on the 10.2.x branch and run clang-format checks.