mirrors/haproxy
1
0
Fork 0
mirror of https://git.haproxy.org/git/haproxy.git/ synced 2025-08-06 23:27:04 +02:00
Code Issues Projects Releases Wiki Activity

BUG/MINOR: mux-quic: remove qcs from opening-list on free

Browse Source 
qcs instances for bidirectional streams are inserted in
<qcc.opening_list>. It is removed from the list once a full HTTP request
has been parsed. This is required to implement http-request timeout.

If a qcs instance is freed before receiving a full HTTP request, it must
be removed from the <qcc.opening_list>. Else a segfault will occur in
qcc_refresh_timeout() when accessing a dangling pointer.

For the moment this bug was not reproduced in production. This is
because there exists only few rare cases where a qcs is freed before
HTTP request parsing. However, as error detection will be improved on
H3, this will occur more frequently in the near future.

This must be backported up to 2.6.
This commit is contained in:
Amaury Denoyelle 2022-12-07 11:26:16 +01:00
parent 6eb3c4b71c
commit 641a65ff3c
1 changed files with 3 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
src/mux_quic.c
View File

@ -155,6 +155,9 @@ static void qcs_free(struct qcs *qcs)
TRACE_ENTER(QMUX_EV_QCS_END, qcc->conn, qcs);
if (LIST_INLIST(&qcs->el_opening))
LIST_DELETE(&qcs->el_opening);
qc_free_ncbuf(qcs, &qcs->rx.ncbuf);
b_free(&qcs->tx.buf);