From 91449b0351d54345420d2fbffb0af0a641417473 Mon Sep 17 00:00:00 2001 From: Christopher Faulet Date: Tue, 22 Mar 2022 18:45:55 +0100 Subject: [PATCH] BUG/MINOR: mux-h1: Don't release unallocated CS on error path cs_free() must not be called when we fail to allocate the conn-stream in h1s_new_cs() function. This bug was introduced by the commit cda94accb ("MAJOR: stream/conn_stream: Move the stream-interface into the conn-stream"). It is 2.6-specific, no backport is needed. --- src/mux_h1.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/src/mux_h1.c b/src/mux_h1.c index ecdb381b3..29dee6ff9 100644 --- a/src/mux_h1.c +++ b/src/mux_h1.c @@ -735,7 +735,7 @@ static struct conn_stream *h1s_new_cs(struct h1s *h1s, struct buffer *input) if (!stream_new(h1c->conn->owner, cs, input)) { TRACE_DEVEL("leaving on stream creation failure", H1_EV_STRM_NEW|H1_EV_STRM_END|H1_EV_STRM_ERR, h1c->conn, h1s); - goto err; + goto err_cs; } HA_ATOMIC_INC(&h1c->px_counters->open_streams); @@ -745,8 +745,9 @@ static struct conn_stream *h1s_new_cs(struct h1s *h1s, struct buffer *input) TRACE_LEAVE(H1_EV_STRM_NEW, h1c->conn, h1s); return cs; - err: + err_cs: cs_free(cs); + err: h1s->cs = NULL; TRACE_DEVEL("leaving on error", H1_EV_STRM_NEW|H1_EV_STRM_ERR, h1c->conn, h1s); return NULL;