gamzinav/haproxy
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

BUG/MINOR: quic: Frames added to packets even if not built.

Browse Source 
Several frames could remain as not build into <frm_list> built by qc_build_frms()
after having stopped at the first building error. So only one frame was reinserted in
the frame list passed as parameter to qc_do_build_pkt(). Then <frm_list> was
spliced to the packet frame list even its frames were not built, nor attached to
any packet. Such frames had their ->pkt member set to NULL, but considered as
built, then sent leading to a crash in qc_release_frm() where ->pkt is dereferenced.

This issue was again reported by useful traces provided by Tristan in GH #1808.

Must be backported to 2.6.

(cherry picked from commit 149c531fa185f418def681fbe044d48fca1db66c)
Signed-off-by: Christopher Faulet <cfaulet@haproxy.com>
This commit is contained in:
Frédéric Lécaille 2022-08-27 15:51:30 +02:00 committed by Christopher Faulet
parent 566f7e51d7
commit cacdc14655
1 changed files with 3 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
src/xprt_quic.c
View File

@ -6180,14 +6180,12 @@ static int qc_do_build_pkt(unsigned char *pos, const unsigned char *end,
ssize_t room = end - pos;
TRACE_PROTO("Not enough room", QUIC_EV_CONN_HPKT,
qc, NULL, NULL, &room);
/* TODO: this should not have happened if qc_build_frms()
* had correctly computed and sized the frames to be
* added to this packet. Note that <cf> was added
* from <frm_list> to <frms> list by qc_build_frms().
/* Note that <cf> was added from <frms> to <frm_list> list by
* qc_build_frms().
*/
LIST_DELETE(&cf->list);
LIST_INSERT(frms, &cf->list);
break;
continue;
}
quic_tx_packet_refinc(pkt);