kozorizki/haproxy
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

BUG/MEDIUM: h2: Follow the same logic in h2_deferred_shut than in h2_snd_buf.

Browse Source 
In h2_deferred_shut(), don't just set h2s->send_wait to NULL, instead, use
the same logic as in h2_snd_buf() and only do so if we successfully sent data
(or if we don't want to send them anymore). Setting it to NULL can lead to
crashes.

This should be backported to 1.9.
This commit is contained in:
Olivier Houchard 2019-03-25 14:08:01 +01:00 committed by Olivier Houchard
parent fd1e96d2fb
commit afc7cb85c4
1 changed files with 8 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
src/mux_h2.c
View File

@ -3220,17 +3220,22 @@ static struct task *h2_deferred_shut(struct task *t, void *ctx, unsigned short s
long reason = (long)h2s->wait_event.handle;
int ret = 0;
LIST_DEL_INIT(&h2s->sending_list);
if (h2s->send_wait) {
h2s->send_wait->events &= ~SUB_CALL_UNSUBSCRIBE;
h2s->send_wait = NULL;
LIST_DEL(&h2s->list);
LIST_INIT(&h2s->list);
h2s->send_wait->events |= SUB_RETRY_SEND;
}
if (reason & 2)
ret |= h2_do_shutw(h2s);
if (reason & 1)
ret |= h2_do_shutr(h2s);
if (!ret) {
/* We're done trying to send, remove ourself from the send_list */
h2s->send_wait->events &= ~SUB_RETRY_SEND;
h2s->send_wait = NULL;
LIST_DEL_INIT(&h2s->list);
}
/* We're no longer trying to send anything, let's destroy the h2s */
if (!ret && (h2s->cs == NULL)) {
struct h2c *h2c = h2s->h2c;