RepoMirrors/haproxy
1
0
Fork 0
mirror of http://git.haproxy.org/git/haproxy.git/ synced 2025-01-04 11:12:02 +00:00
Code Issues Packages Projects Releases Wiki Activity

BUG/MAJOR: mux-h2: don't destroy the stream on failed allocation in h2_snd_buf()

Browse Source 
In case we cannot allocate a stream ID for an outgoing stream, the stream
will be aborted. The problem is that we also release it and it will be
destroyed again by the application detecting the error, leading to a NULL
dereference in h2_shutr() and h2_shutw(). Let's only mark the error on the
CS and let the rest of the code handle the close.

This should be backported to 1.9.
This commit is contained in:
Willy Tarreau 2019-01-23 14:39:41 +01:00
parent b57af617c0
commit 759ca1eacc
1 changed files with 0 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
src/mux_h2.c
View File

@ -5141,9 +5141,7 @@ static size_t h2_snd_buf(struct conn_stream *cs, struct buffer *buf, size_t coun
int32_t id = h2c_get_next_sid(h2s->h2c);
if (id < 0) {
cs->ctx = NULL;
cs->flags |= CS_FL_ERROR;
h2s_destroy(h2s);
return 0;
}