mirrors/haproxy
1
0
Fork 0
mirror of https://git.haproxy.org/git/haproxy.git/ synced 2025-09-22 14:21:25 +02:00
Code Issues Projects Releases Wiki Activity

BUG/MINOR: h2: null-deref

Browse Source 
h2c can be null if pool_alloc() failed.
Bypass tasklet_free and pool_free if pool_alloc did fail.
This commit is contained in:
mildis 2018-10-02 16:44:18 +02:00 committed by Willy Tarreau
parent 27346b01aa
commit cd2d7de44e
1 changed files with 3 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
src/mux_h2.c
View File

@ -356,7 +356,7 @@ static int h2c_frt_init(struct connection *conn)
h2c = pool_alloc(pool_head_h2c); h2c = pool_alloc(pool_head_h2c);
if (!h2c) if (!h2c)
goto fail; goto fail_no_h2c;
h2c->shut_timeout = h2c->timeout = sess->fe->timeout.client; h2c->shut_timeout = h2c->timeout = sess->fe->timeout.client;
@ -420,12 +420,13 @@ static int h2c_frt_init(struct connection *conn)
conn_xprt_want_recv(conn); conn_xprt_want_recv(conn);
tasklet_wakeup(h2c->wait_list.task); tasklet_wakeup(h2c->wait_list.task);
return 0; return 0;
fail: fail:
if (t) if (t)
task_free(t); task_free(t);
if (h2c->wait_list.task) if (h2c->wait_list.task)
tasklet_free(h2c->wait_list.task); tasklet_free(h2c->wait_list.task);
pool_free(pool_head_h2c, h2c); pool_free(pool_head_h2c, h2c);
fail_no_h2c:
return -1; return -1;
} }