From 45efc07cb5a4cd33a3ef0808e43f3440ad1d6368 Mon Sep 17 00:00:00 2001 From: Willy Tarreau Date: Wed, 3 Oct 2018 18:27:52 +0200 Subject: [PATCH] BUG/MEDIUM: h2: make h2_stream_new() return an error on memory allocation failure Commit 8ae735da0 ("MEDIUM: mux_h2: Revamp the send path when blocking.") added a tasklet allocation in h2_stream_new(), however the error exit path fails to reset h2s in case the tasklet cannot be allocated, resulting in the h2s pointer to be returned as valid to the caller. Let's readjust the exit path to always return NULL on error and to always log as well (since there is no reason for not logging on such important errors). No backport is needed, this is strictly 1.9-dev. --- src/mux_h2.c | 13 +++++++------ 1 file changed, 7 insertions(+), 6 deletions(-) diff --git a/src/mux_h2.c b/src/mux_h2.c index 62eb909b39..2839ea16ae 100644 --- a/src/mux_h2.c +++ b/src/mux_h2.c @@ -684,10 +684,9 @@ static struct h2s *h2c_stream_new(struct h2c *h2c, int id) goto out; h2s->wait_list.task = tasklet_new(); - if (!h2s->wait_list.task) { - pool_free(pool_head_h2s, h2s); - goto out; - } + if (!h2s->wait_list.task) + goto out_free_h2s; + LIST_INIT(&h2s->wait_list.list); h2s->recv_wait_list = NULL; h2s->wait_list.task->process = h2_deferred_shut; @@ -743,9 +742,11 @@ static struct h2s *h2c_stream_new(struct h2c *h2c, int id) out_close: h2s_destroy(h2s); h2s = NULL; - sess_log(sess); + out_free_h2s: + pool_free(pool_head_h2s, h2s); out: - return h2s; + sess_log(sess); + return NULL; } /* try to send a settings frame on the connection. Returns > 0 on success, 0 if