Dry-run segmentation faults in azure_blob, nats & kafka-rest output plugins

[patrick-stephens]

Bug Report

Describe the bug
The documented examples for the following plugins all fail with a segmentation fault during validation of --dry-run with the 5.0.9 Linux container image:

• https://docs.fluentbit.io/manual/data-pipeline/outputs/azure_blob#configuration-for-azure-storage
• https://docs.fluentbit.io/manual/data-pipeline/outputs/nats#configuration-file
• https://docs.fluentbit.io/manual/data-pipeline/outputs/kafka-rest-proxy#configuration-file

Possibly related to #11789.

To Reproduce

Use the configurations in the examples:

service:
  flush: 1
  log_level: info

pipeline:
  inputs:
    - name: dummy
      dummy: '{"name": "Fluent Bit", "year": 2020}'
      samples: 1
      tag: var.log.containers.app-default-96cbdef2340.log

  outputs:
    - name: azure_blob
      match: "*"
      account_name: YOUR_ACCOUNT_NAME
      shared_key: YOUR_SHARED_KEY
      path: kubernetes
      container_name: logs
      auto_create_container: on
      tls: on

Run with the container image:

$ docker run --rm -it -v $PWD/fluent-bit.yaml:/etc/fluent-bit.yaml:ro fluent/fluent-bit:5.0.9 --dry-run --config=/etc/fluent-bit.yaml
Unable to find image 'fluent/fluent-bit:5.0.9' locally
5.0.9: Pulling from fluent/fluent-bit
Digest: sha256:ccda4cbd0f87be1e04cc1d5425bc84a6669051d4ac93a6b7a053c3ba9832aa14
Status: Downloaded newer image for fluent/fluent-bit:5.0.9
Fluent Bit v5.0.9
* Copyright (C) 2015-2026 The Fluent Bit Authors
* Fluent Bit is a CNCF graduated project under the Fluent organization
* https://fluentbit.io

______ _                  _    ______ _ _           _____  _____ 
|  ___| |                | |   | ___ (_) |         |  ___||  _  |
| |_  | |_   _  ___ _ __ | |_  | |_/ /_| |_  __   _|___ \ | |/' |
|  _| | | | | |/ _ \ '_ \| __| | ___ \ | __| \ \ / /   \ \|  /| |
| |   | | |_| |  __/ | | | |_  | |_/ / | |_   \ V //\__/ /\ |_/ /
\_|   |_|\__,_|\___|_| |_|\__| \____/|_|\__|   \_/ \____(_)\___/


[2026/07/19 13:56:19] [engine] caught signal (SIGSEGV)
#0  0x64d37303561f      in  flb_output_exit() at src/flb_output.c:576
#1  0x64d37304a244      in  flb_engine_shutdown() at src/flb_engine.c:1369
#2  0x64d373017ba4      in  flb_destroy() at src/flb_lib.c:246
#3  0x64d372f83848      in  flb_main_run() at src/fluent-bit.c:1449
#4  0x7c5752ca2ca7      in  ???() at ???:0
#5  0x7c5752ca2d64      in  ???() at ???:0
#6  0x64d372f81260      in  ???() at ???:0
#7  0xffffffffffffffff  in  ???() at ???:0

Repeat for the other examples:

Expected behavior

Dry run validation can fail if configuration is incorrect but it should not trigger a segmentation fault.

Your Environment

• Version used: 5.0.9 Linux container image
• Configuration: See above
• Operating System and version: Ubuntu 24.04 AMD64

Additional context

As part of work on fluent/fluent-bit-docs#2627 trying to automatically validate any configuration provided during CI for documentation.
Unfortunately this triggers a failure with the latest release.

[patrick-stephens]

Using latest master build shows the same failure.
Looks like the fix from #11800 is already in place for azure_blob output, i.e. checking for NULL ctx:

fluent-bit/plugins/out_azure_blob/azure_blob.c

Lines 2373 to 2375 in fd5ea1f

	if (!ctx) {
	return 0;
	}

Failure is related to worker exit it seems:

fluent-bit/src/flb_output.c

Lines 574 to 578 in fd5ea1f

	if (ins->is_threaded == FLB_FALSE) {
	if (ins->p->cb_worker_exit) {
	ins->p->cb_worker_exit(ins->context, ins->config);
	}
	}

Running it with the debug image to then use gdb shows it is in cb_worker_exit as we are passed a null pointer for data:

fluent-bit/plugins/out_azure_blob/azure_blob.c

Line 2433 in fd5ea1f

flb_plg_info(ctx->ins, "initializing worker");

Adding a null check here resolves the issue plus similar failures in the other plugins are also resolved in the same way.
So, it is related to #11800 in that we need some more null checks.