mirrors/haproxy
1
0
Fork 0
mirror of https://git.haproxy.org/git/haproxy.git/ synced 2025-08-06 15:17:01 +02:00
Code Issues Projects Releases Wiki Activity

BUG/MEDIUM: h2: only destroy the h2s if h2s->cs is NULL.

Browse Source 
In h2_deferred_shut(), only attempt to destroy the h2s if h2s->cs is NULL.
h2s->cs being non-NULL means it's still referenced by the stream interface,
so it may try to use it later, and that could lead to a crash.

This should be backported to 1.9.
This commit is contained in:
Olivier Houchard 2019-03-25 13:25:02 +01:00 committed by Olivier Houchard
parent 66af0b2b99
commit 01d4cb5339
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
src/mux_h2.c
View File

@ -3233,7 +3233,7 @@ static struct task *h2_deferred_shut(struct task *t, void *ctx, unsigned short s
ret |= h2_do_shutr(h2s);
/* We're no longer trying to send anything, let's destroy the h2s */
if (!ret) {
if (!ret && (h2s->cs == NULL)) {
struct h2c *h2c = h2s->h2c;
h2s_destroy(h2s);