28 lines
1.2 KiB
C
28 lines
1.2 KiB
C
|
commit 5818f8a6693b3c0d95021f2ee58b69dcf848911c
|
||
|
|
Author: Roman Arutyunyan <arut@nginx.com>
|
||
|
|
Date: Wed Feb 14 15:55:37 2024 +0400
|
||
|
|
|
||
|
|
QUIC: fixed stream cleanup (ticket #2586).
|
||
|
|
|
||
|
|
Stream connection cleanup handler ngx_quic_stream_cleanup_handler() calls
|
||
|
|
ngx_quic_shutdown_stream() after which it resets the pointer from quic stream
|
||
|
|
to the connection (sc->connection = NULL). Previously if this call failed,
|
||
|
|
sc->connection retained the old value, while the connection was freed by the
|
||
|
|
application code. This resulted later in a second attempt to close the freed
|
||
|
|
connection, which lead to allocator double free error.
|
||
|
|
|
||
|
|
The fix is to reset the sc->connection pointer in case of error.
|
||
|
|
|
||
|
|
diff --git a/src/event/quic/ngx_event_quic_streams.c b/src/event/quic/ngx_event_quic_streams.c
|
||
|
|
index df04d0f07..178b805e4 100644
|
||
|
|
--- a/src/event/quic/ngx_event_quic_streams.c
|
||
|
|
+++ b/src/event/quic/ngx_event_quic_streams.c
|
||
|
|
@@ -1097,6 +1097,7 @@ ngx_quic_stream_cleanup_handler(void *data)
|
||
|
|
"quic stream id:0x%xL cleanup", qs->id);
|
||
|
|
|
||
|
|
if (ngx_quic_shutdown_stream(c, NGX_RDWR_SHUTDOWN) != NGX_OK) {
|
||
|
|
+ qs->connection = NULL;
|
||
|
|
goto failed;
|
||
|
|
}
|
||
|
|
|