From: Olivier Houchard <ohouchard@haproxy.com>
Date: Mon, 15 Apr 2019 17:22:24 +0000 (+0200)
Subject: BUG/MEDIUM: h2: Make sure we're not already in the send_list in h2_subscribe().
X-Git-Tag: v2.0-dev3~273
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=9a0f559676c4d309edbe42ba33197e7dd8935f1c;p=thirdparty%2Fhaproxy.git

BUG/MEDIUM: h2: Make sure we're not already in the send_list in h2_subscribe().

In h2_subscribe(), don't add ourself to the send_list if we're already in it.
That may happen if we try to send and fail twice, as we're only removed
from the send_list if we managed to send data, to promote fairness.
Failing to do so can lead to either an infinite loop, or some random crashes,
as we'd get the same h2s in the send_list twice.

This should be backported to 1.9.
---

diff --git a/src/mux_h2.c b/src/mux_h2.c
index adcd0b4df7..685d583855 100644
--- a/src/mux_h2.c
+++ b/src/mux_h2.c
@@ -5150,7 +5150,8 @@ static int h2_subscribe(struct conn_stream *cs, int event_type, void *param)
 			sw->events |= SUB_RETRY_SEND;
 			sw->handle = h2s;
 			h2s->send_wait = sw;
-			if (!(h2s->flags & H2_SF_BLK_SFCTL)) {
+			if (!(h2s->flags & H2_SF_BLK_SFCTL) &&
+			    LIST_ISEMPTY(&h2s->list)) {
 				if (h2s->flags & H2_SF_BLK_MFCTL)
 					LIST_ADDQ(&h2c->fctl_list, &h2s->list);
 				else