From: Christopher Faulet <cfaulet@haproxy.com>
Date: Tue, 22 Mar 2022 17:45:55 +0000 (+0100)
Subject: BUG/MINOR: mux-h1: Don't release unallocated CS on error path
X-Git-Tag: v2.6-dev6~110
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=91449b0351d54345420d2fbffb0af0a641417473;p=thirdparty%2Fhaproxy.git

BUG/MINOR: mux-h1: Don't release unallocated CS on error path

cs_free() must not be called when we fail to allocate the conn-stream in
h1s_new_cs() function. This bug was introduced by the commit cda94accb
("MAJOR: stream/conn_stream: Move the stream-interface into the
conn-stream").

It is 2.6-specific, no backport is needed.
---

diff --git a/src/mux_h1.c b/src/mux_h1.c
index ecdb381b3d..29dee6ff94 100644
--- a/src/mux_h1.c
+++ b/src/mux_h1.c
@@ -735,7 +735,7 @@ static struct conn_stream *h1s_new_cs(struct h1s *h1s, struct buffer *input)
 
 	if (!stream_new(h1c->conn->owner, cs, input)) {
 		TRACE_DEVEL("leaving on stream creation failure", H1_EV_STRM_NEW|H1_EV_STRM_END|H1_EV_STRM_ERR, h1c->conn, h1s);
-		goto err;
+		goto err_cs;
 	}
 
 	HA_ATOMIC_INC(&h1c->px_counters->open_streams);
@@ -745,8 +745,9 @@ static struct conn_stream *h1s_new_cs(struct h1s *h1s, struct buffer *input)
 	TRACE_LEAVE(H1_EV_STRM_NEW, h1c->conn, h1s);
 	return cs;
 
-  err:
+  err_cs:
 	cs_free(cs);
+  err:
 	h1s->cs = NULL;
 	TRACE_DEVEL("leaving on error", H1_EV_STRM_NEW|H1_EV_STRM_ERR, h1c->conn, h1s);
 	return NULL;