From 389ab0d4b4031c1a7f05fe1b4607f31737b5b9b9 Mon Sep 17 00:00:00 2001 From: Willy Tarreau Date: Mon, 20 Mar 2023 19:16:04 +0100 Subject: [PATCH] BUG/MEDIUM: mux-h2: erase h2c->wait_event.tasklet on error path On the allocation error path in h2_init() we may check if h2c->wait_event.tasklet needs to be released but it has not yet been zeroed. Let's do this before jumping to the freeing location. This needs to be backported to all maintained versions. --- src/mux_h2.c | 1 + 1 file changed, 1 insertion(+) diff --git a/src/mux_h2.c b/src/mux_h2.c index 1d4dd3a75..869779968 100644 --- a/src/mux_h2.c +++ b/src/mux_h2.c @@ -962,6 +962,7 @@ static int h2_init(struct connection *conn, struct proxy *prx, struct session *s h2c->proxy = prx; h2c->task = NULL; + h2c->wait_event.tasklet = NULL; h2c->idle_start = now_ms; if (tick_isset(h2c->timeout)) { t = task_new_here();