From: Willy Tarreau <w@1wt.eu>
Date: Fri, 3 Nov 2017 14:55:24 +0000 (+0100)
Subject: BUG/MAJOR: mux_pt: don't dereference a connstream after ->wake()
X-Git-Tag: v1.8-rc2~2
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=ed339a375c1e4c1a30121dfb5469183be07e060e;p=thirdparty%2Fhaproxy.git

BUG/MAJOR: mux_pt: don't dereference a connstream after ->wake()

The wake() callback may destroy a connstream, so it must not be
dereferenced in case wake() returns negative. No backport needed,
this is 1.8-only.
---

diff --git a/src/mux_pt.c b/src/mux_pt.c
index 479f831c69..cd3a28b42a 100644
--- a/src/mux_pt.c
+++ b/src/mux_pt.c
@@ -51,8 +51,9 @@ static int mux_pt_wake(struct connection *conn)
 
 	ret = cs->data_cb->wake ? cs->data_cb->wake(cs) : 0;
 
-	cs_update_mux_polling(cs);
-	return (ret);
+	if (ret >= 0)
+		cs_update_mux_polling(cs);
+	return ret;
 }
 
 /* callback used to update the mux's polling flags after changing a cs' status.