From: Willy Tarreau <w@1wt.eu>
Date: Fri, 30 Aug 2019 12:57:17 +0000 (+0200)
Subject: BUG/MEDIUM: mux-h2/trace: do not dereference h2c->conn after failed idle
X-Git-Tag: v2.1-dev2~133
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=fe1c908744dc36f2c2b5a71eead822a64ef64a48;p=thirdparty%2Fhaproxy.git

BUG/MEDIUM: mux-h2/trace: do not dereference h2c->conn after failed idle

In h2_detach(), if session_check_idle_conn() returns <0 we must not
dereference it since it has been freed.

No backport is needed.
---

diff --git a/src/mux_h2.c b/src/mux_h2.c
index 7bbaca9c9f..f4ab7c6714 100644
--- a/src/mux_h2.c
+++ b/src/mux_h2.c
@@ -3751,7 +3751,7 @@ static void h2_detach(struct conn_stream *cs)
 			if (eb_is_empty(&h2c->streams_by_id)) {
 				if (session_check_idle_conn(h2c->conn->owner, h2c->conn) != 0)
 					/* At this point either the connection is destroyed, or it's been added to the server idle list, just stop */
-					TRACE_DEVEL("leaving with non-reusable idle connection", H2_EV_STRM_END, h2c->conn);
+					TRACE_DEVEL("leaving without reusable idle connection", H2_EV_STRM_END);
 					return;
 			}
 			/* Never ever allow to reuse a connection from a non-reuse backend */