From e8c1023b00b4b1491d0436f8bc95fe589ad659ed Mon Sep 17 00:00:00 2001
From: Daniel Stenberg <daniel@haxx.se>
Date: Sat, 16 May 2026 23:59:05 +0200
Subject: [PATCH] connect: remove deref of freed pointer in trace call

Spotted by CodeSonar

Closes #21649
---
 lib/connect.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/lib/connect.c b/lib/connect.c
index e0f93d3c46..e74bda5dfb 100644
--- a/lib/connect.c
+++ b/lib/connect.c
@@ -389,10 +389,13 @@ connect_sub_chain:
       cf->conn->socks_proxy.proxytype,
       cf->conn->socks_proxy.creds);
 
+    if(result) {
+      /* 'dest' might be freed now so it can't be dereferenced */
+      CURL_TRC_CF(data, cf, "added SOCKS filter failed -> %d", result);
+      return result;
+    }
     CURL_TRC_CF(data, cf, "added SOCKS filter to %s:%u -> %d",
                 dest->hostname, dest->port, result);
-    if(result)
-      return result;
     ctx->state = CF_SETUP_CNNCT_SOCKS;
     if(!cf->next || !cf->next->connected)
       goto connect_sub_chain;