mirrors/haproxy
1
0
Fork 0
mirror of https://git.haproxy.org/git/haproxy.git/ synced 2025-12-11 20:51:01 +01:00
Code Issues Projects Releases Wiki Activity

BUG/MINOR: quic: Wrong list_for_each_entry() use when building packets from qc_do_build_pkt()

Browse Source 
This is list_for_each_entry_safe() which must be used if we want to delete elements
inside its code block. This could explain that some frames which were not built were added
to packets with a NULL ->pkt member.

Thank you to Tristan for having reported this issue through backtraces in GH #1808

Must be backported to 2.6.
This commit is contained in:
Frédéric Lécaille 2022-08-23 11:42:48 +02:00
parent da9c441886
commit a8a6043240
1 changed files with 2 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
src/xprt_quic.c
View File

@ -6830,7 +6830,8 @@ static int qc_do_build_pkt(unsigned char *pos, const unsigned char *end,
/* Ack-eliciting frames */ /* Ack-eliciting frames */
if (!LIST_ISEMPTY(&frm_list)) { if (!LIST_ISEMPTY(&frm_list)) {
list_for_each_entry(cf, &frm_list, list) { struct quic_frame *tmp_cf;
list_for_each_entry_safe(cf, tmp_cf, &frm_list, list) {
unsigned char *spos = pos; unsigned char *spos = pos;
if (!qc_build_frm(&spos, end, cf, pkt, qc)) { if (!qc_build_frm(&spos, end, cf, pkt, qc)) {