Fix possible nullptr dereference in evhttp_send_reply_end()

(The existing implementation had sanity-checking code for the case where
 its argument was NULL, but it erroneously dereferenced it before actually
 doing the sanity-check. --nickm)

diff --git a/http.c b/http.c
index 3f39e0bfa604dbcbb278fcfcecca35b5693d4acb..19d4f91df0848d9f2f5a5239b15e359e5cf1bdc9 100644 (file)
--- a/http.c
+++ b/http.c
@@ -2145,13 +2145,15 @@ void
 evhttp_send_reply_end(struct evhttp_request *req)
 {
        struct evhttp_connection *evcon = req->evcon;
-       struct evbuffer *output = bufferevent_get_output(evcon->bufev);
+       struct evbuffer *output;
 
        if (evcon == NULL) {
                evhttp_request_free(req);
                return;
        }
 
+       output = bufferevent_get_output(evcon->bufev);
+
        /* we expect no more calls form the user on this request */
        req->userdone = 1;