From: Willy Tarreau <w@1wt.eu>
Date: Thu, 16 Mar 2023 17:06:19 +0000 (+0100)
Subject: BUG/MINOR: mux-h2: make sure the h2c task exists before refreshing it
X-Git-Tag: v2.8-dev6~57
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=3fb2c6d5b40bf64d7e4f3fef88739b757555fbff;p=thirdparty%2Fhaproxy.git

BUG/MINOR: mux-h2: make sure the h2c task exists before refreshing it

When detaching a stream, if it's the last one and the mbuf is blocked,
we leave without freeing the stream yet. We also refresh the h2c task's
timeout, except that it's possible that there's no such task in case
there is no client timeout, causing a crash. The fix just consists in
doing this when the task exists.

This bug has always been there and is extremely hard to meet even
without a client timeout. This fix has to be backported to all
branches, but it's unlikely anyone has ever met it anyay.
---

diff --git a/src/mux_h2.c b/src/mux_h2.c
index 4b426394c0..1edc0d22cf 100644
--- a/src/mux_h2.c
+++ b/src/mux_h2.c
@@ -4312,7 +4312,7 @@ static void h2_detach(struct sedesc *sd)
 		/* refresh the timeout if none was active, so that the last
 		 * leaving stream may arm it.
 		 */
-		if (!tick_isset(h2c->task->expire))
+		if (h2c->task && !tick_isset(h2c->task->expire))
 			h2c_update_timeout(h2c);
 		return;
 	}