From 9b22f22858a2af3a6a5b36ea5c079ebd084d44fc Mon Sep 17 00:00:00 2001 From: Christopher Faulet Date: Thu, 5 Mar 2026 14:18:41 +0100 Subject: [PATCH] BUG/MEDIUM: mux-fcgi: Use a safe loop to resume each stream eligible for sending At the end of fcgi_send(), if the connection is not full anymore, we loop on the send list to resume FCGI stream for sending. But a streams may be removed from the this list during the loop. So a safe loop must be used. This patch should be backported to all stable versions. --- src/mux_fcgi.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/mux_fcgi.c b/src/mux_fcgi.c index 33153fffa..5f84b1183 100644 --- a/src/mux_fcgi.c +++ b/src/mux_fcgi.c @@ -2987,9 +2987,9 @@ static int fcgi_send(struct fcgi_conn *fconn) * for us. */ if (!(fconn->flags & (FCGI_CF_MUX_MFULL | FCGI_CF_DEM_MROOM)) && fconn->state >= FCGI_CS_RECORD_H) { - struct fcgi_strm *fstrm; + struct fcgi_strm *fstrm, *fstrm_back; - list_for_each_entry(fstrm, &fconn->send_list, send_list) { + list_for_each_entry_safe(fstrm, fstrm_back, &fconn->send_list, send_list) { if (fconn->state == FCGI_CS_CLOSED || fconn->flags & FCGI_CF_MUX_BLOCK_ANY) break;