gamzinav/haproxy
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

BUG/MINOR: quic: Wrong list_for_each_entry() use when building packets from qc_do_build_pkt()

Browse Source 
This is list_for_each_entry_safe() which must be used if we want to delete elements
inside its code block. This could explain that some frames which were not built were added
to packets with a NULL ->pkt member.

Thank you to Tristan for having reported this issue through backtraces in GH #1808

Must be backported to 2.6.

(cherry picked from commit a8a60432406d7bfd06975e087650a8817c03fcf6)
Signed-off-by: Christopher Faulet <cfaulet@haproxy.com>
This commit is contained in:
Frédéric Lécaille 2022-08-23 11:42:48 +02:00 committed by Christopher Faulet
parent 2a2078cbac
commit 0ebceedaf4
1 changed files with 2 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
src/xprt_quic.c
View File

@ -6197,7 +6197,8 @@ static int qc_do_build_pkt(unsigned char *pos, const unsigned char *end,
/* Ack-eliciting frames */
if (!LIST_ISEMPTY(&frm_list)) {
list_for_each_entry(cf, &frm_list, list) {
struct quic_frame *tmp_cf;
list_for_each_entry_safe(cf, tmp_cf, &frm_list, list) {
unsigned char *spos = pos;
if (!qc_build_frm(&spos, end, cf, pkt, qc)) {