From ad7f0ad1c3c9c541a4c315b24d4500405d1383ee Mon Sep 17 00:00:00 2001 From: Willy Tarreau Date: Fri, 24 Aug 2018 15:48:59 +0200 Subject: [PATCH] BUG/MEDIUM: mux_pt: dereference the connection with care in mux_pt_wake() mux_pt_wake() calls data->wake() which can return -1 indicating that the connection was just destroyed. We need to check for this condition and immediately exit in this case otherwise we dereference a just freed connection. Note that this mainly happens on idle connections between two HTTP requests. It can have random implications between requests as it may lead a wrong connection's polling to be re-enabled or disabled for example, especially with threads. This patch must be backported to 1.8. --- src/mux_pt.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/src/mux_pt.c b/src/mux_pt.c index dbdd78b094..71f26e7534 100644 --- a/src/mux_pt.c +++ b/src/mux_pt.c @@ -51,6 +51,9 @@ static int mux_pt_wake(struct connection *conn) ret = cs->data_cb->wake ? cs->data_cb->wake(cs) : 0; + if (ret < 0) + return ret; + /* If we had early data, and we're done with the handshake * then whe know the data are safe, and we can remove the flag. */