BUG/MEDIUM: h2: Don't forget to set h2s->cs to NULL after having free'd cs.

In h2c_frt_stream_new, if we failed to create the stream for some reason,
don't forget to set h2s->cs to NULL before calling h2s_destroy(), otherwise
h2s_destroy() will call h2s_close(), which will attempt to access
h2s->cs->flags if it's non-NULL.

This should be backported to 1.9.

diff --git a/src/mux_h2.c b/src/mux_h2.c
index 8b8135d1a178ea18d971814a1389d3479e9fe5fd..557a158cab68b52d6853e17627f1873fa22500b3 100644 (file)
--- a/src/mux_h2.c
+++ b/src/mux_h2.c
@@ -1027,6 +1027,7 @@ static struct h2s *h2c_frt_stream_new(struct h2c *h2c, int id)
  out_free_cs:
        h2c->nb_cs--;
        cs_free(cs);
+       h2s->cs = NULL;
  out_close:
        h2s_destroy(h2s);
  out: