From: Amaury Denoyelle <adenoyelle@haproxy.com>
Date: Thu, 21 Apr 2022 14:29:27 +0000 (+0200)
Subject: BUG/MINOR: mux-quic: handle null timeout
X-Git-Tag: v2.6-dev7~23
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=a3daaec5a6e3d1342be288105296df68162737b3;p=thirdparty%2Fhaproxy.git

BUG/MINOR: mux-quic: handle null timeout

Do not initialize mux task timeout if timeout client is set to 0 in the
configuration. Check for the task before queuing it in qc_io_cb() or
qc_detach().

This fix a crash when timeout client is 0 or undefined.
---

diff --git a/src/mux_quic.c b/src/mux_quic.c
index 31ef6d5560..c0ab6151ce 100644
--- a/src/mux_quic.c
+++ b/src/mux_quic.c
@@ -1028,7 +1028,7 @@ static struct task *qc_io_cb(struct task *t, void *ctx, unsigned int status)
 		if (qcc_is_dead(qcc)) {
 			qc_release(qcc);
 		}
-		else {
+		else if (qcc->task) {
 			if (qcc_may_expire(qcc))
 				qcc->task->expire = tick_add(now_ms, qcc->timeout);
 			else
@@ -1150,13 +1150,16 @@ static int qc_init(struct connection *conn, struct proxy *prx,
 	qcc->wait_event.events = 0;
 
 	/* haproxy timeouts */
+	qcc->task = NULL;
 	qcc->timeout = prx->timeout.client;
-	qcc->task = task_new_here();
-	if (!qcc->task)
-		goto fail_no_timeout_task;
-	qcc->task->process = qc_timeout_task;
-	qcc->task->context = qcc;
-	qcc->task->expire = tick_add(now_ms, qcc->timeout);
+	if (tick_isset(qcc->timeout)) {
+		qcc->task = task_new_here();
+		if (!qcc->task)
+			goto fail_no_timeout_task;
+		qcc->task->process = qc_timeout_task;
+		qcc->task->context = qcc;
+		qcc->task->expire = tick_add(now_ms, qcc->timeout);
+	}
 
 	if (!conn_is_back(conn)) {
 		if (!LIST_INLIST(&conn->stopping_list)) {
@@ -1210,7 +1213,7 @@ static void qc_detach(struct conn_stream *cs)
 	if (qcc_is_dead(qcc)) {
 		qc_release(qcc);
 	}
-	else {
+	else if (qcc->task) {
 		if (qcc_may_expire(qcc))
 			qcc->task->expire = tick_add(now_ms, qcc->timeout);
 		else