mirrors/haproxy
1
0
Fork 0
mirror of https://git.haproxy.org/git/haproxy.git/ synced 2026-05-04 20:46:11 +02:00
Code Issues Projects Releases Wiki Activity

BUG/MEDIUM: mux-h2: do not try to free an unallocated h2s->sd

Browse Source 
In h2s_close() we may dereference h2s->sd to get the sc, but this
function may be called on allocation error paths, so we must check
for this specific condition. Let's also update the comment to make
it explicitly permitted.

This needs to be backported to 2.6.
This commit is contained in:
Willy Tarreau 2023-03-20 19:14:47 +01:00
parent a45e7e81ec
commit bcdc6cc15b
1 changed files with 4 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
src/mux_h2.c
View File

@ -1397,7 +1397,9 @@ static int h2_fragment_headers(struct buffer *b, uint32_t mfs)
/* marks stream <h2s> as CLOSED and decrement the number of active streams for
* its connection if the stream was not yet closed. Please use this exclusively
* before closing a stream to ensure stream count is well maintained.
* before closing a stream to ensure stream count is well maintained. Note that
* it does explicitly support being called with a partially initialized h2s
* (e.g. sd==NULL).
*/
static inline void h2s_close(struct h2s *h2s)
{
@ -1406,7 +1408,7 @@ static inline void h2s_close(struct h2s *h2s)
h2s->h2c->nb_streams--;
if (!h2s->id)
h2s->h2c->nb_reserved--;
if (h2s_sc(h2s)) {
if (h2s->sd && h2s_sc(h2s)) {
if (!se_fl_test(h2s->sd, SE_FL_EOS) && !b_data(&h2s->rxbuf))
h2s_notify_recv(h2s);
}