RepoMirrors/haproxy
1
0
Fork 0
mirror of http://git.haproxy.org/git/haproxy.git/ synced 2025-03-29 22:57:06 +00:00
Code Issues Packages Projects Releases Wiki Activity

BUG/MEDIUM: mux-quic: fix crash on STOP_SENDING received without SD

Browse Source 
Abort reason code received on STOP_SENDING is notified to upper layer
since the following commit :
  367ce1ebf3
  MINOR: mux-quic: Set tha SE abort reason when a STOP_SENDING frame is received

However, this causes a crash when a STOP_SENDING is received on a QCS
instance without any stream instantiated. Fix this by checking first if
qcs->sd is not NULL before setting abort code.

This bug can easily be reproduced by emitting a STOP_SENDING as first
frame of a stream.

This should fix github issue #2563.

This does not need to be backported.
This commit is contained in:
Amaury Denoyelle 2024-05-10 10:42:07 +02:00
parent fbbc2925d4
commit cc9827bb09
1 changed files with 11 additions and 11 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

22
src/mux_quic.c
View File

@ -1585,18 +1585,18 @@ int qcc_recv_stop_sending(struct qcc *qcc, uint64_t id, uint64_t err)
}
}
/* If FIN already reached, future RESET_STREAMS will be ignored.
* Manually set EOS in this case.
*/
if (qcs_sc(qcs) && se_fl_test(qcs->sd, SE_FL_EOI)) {
se_fl_set(qcs->sd, SE_FL_EOS);
qcs_alert(qcs);
}
if (qcs_sc(qcs)) {
/* Manually set EOS if FIN already reached as futures RESET_STREAM will be ignored in this case. */
if (se_fl_test(qcs->sd, SE_FL_EOI)) {
se_fl_set(qcs->sd, SE_FL_EOS);
qcs_alert(qcs);
}
/* If not defined yet, set abort info for the sedesc */
if (!qcs->sd->abort_info.info) {
qcs->sd->abort_info.info = (SE_ABRT_SRC_MUX_QUIC << SE_ABRT_SRC_SHIFT);
qcs->sd->abort_info.code = err;
/* If not defined yet, set abort info for the sedesc */
if (!qcs->sd->abort_info.info) {
qcs->sd->abort_info.info = (SE_ABRT_SRC_MUX_QUIC << SE_ABRT_SRC_SHIFT);
qcs->sd->abort_info.code = err;
}
}
/* RFC 9000 3.5. Solicited State Transitions