From 0c366a87619206d1bf1c9f69698933d0e58b7be5 Mon Sep 17 00:00:00 2001 From: Christopher Faulet Date: Fri, 18 Dec 2020 15:13:47 +0100 Subject: [PATCH] BUG/MEDIUM: mux-h1: Handle h1_process() failures on a pipelined request On frontend side, when a conn-stream is detached from a H1 connection, the H1 stream is destroyed and if we already have some data to parse (a pipelined request), we process these data immedialtely calling h1_process(). Then we adjust the H1 connection timeout. But h1_process() may fail and release the H1 connection. For instance, a parsing error may be reported. Thus, when that happens, we must not use anymore the H1 connection and exit. This patch must be backported as far as the 2.2. This bug can impact the 2.3 and the 2.2, in theory, if h1 stream creation fails. But, concretly, it only fails on the 2.4 because the requests are now parsed at this step. --- src/mux_h1.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/src/mux_h1.c b/src/mux_h1.c index 885269909..65581589d 100644 --- a/src/mux_h1.c +++ b/src/mux_h1.c @@ -2782,8 +2782,10 @@ static void h1_detach(struct conn_stream *cs) /* If we have a new request, process it immediately or * subscribe for reads waiting for new data */ - if (unlikely(b_data(&h1c->ibuf))) - h1_process(h1c); + if (unlikely(b_data(&h1c->ibuf))) { + if (h1_process(h1c) == -1) + goto end; + } else h1c->conn->xprt->subscribe(h1c->conn, h1c->conn->xprt_ctx, SUB_RETRY_RECV, &h1c->wait_event); }