BUG/MAJOR: mux-h2: don't destroy the stream on failed allocation in h2_snd_buf()

In case we cannot allocate a stream ID for an outgoing stream, the stream
will be aborted. The problem is that we also release it and it will be
destroyed again by the application detecting the error, leading to a NULL
dereference in h2_shutr() and h2_shutw(). Let's only mark the error on the
CS and let the rest of the code handle the close.

This should be backported to 1.9.

diff --git a/src/mux_h2.c b/src/mux_h2.c
index acc38e8e2935b05aeeca2e0b6cd1672358b368d6..47f0e8cc319b278006035862da0f5a16aec5eb1c 100644 (file)
--- a/src/mux_h2.c
+++ b/src/mux_h2.c
@@ -5141,9 +5141,7 @@ static size_t h2_snd_buf(struct conn_stream *cs, struct buffer *buf, size_t coun
                int32_t id = h2c_get_next_sid(h2s->h2c);
 
                if (id < 0) {
-                       cs->ctx = NULL;
                        cs->flags |= CS_FL_ERROR;
-                       h2s_destroy(h2s);
                        return 0;
                }