]> git.ipfire.org Git - thirdparty/haproxy.git/commit
BUG/MEDIUM: mux_pt: dereference the connection with care in mux_pt_wake()
authorWilly Tarreau <w@1wt.eu>
Fri, 24 Aug 2018 13:48:59 +0000 (15:48 +0200)
committerWilly Tarreau <w@1wt.eu>
Fri, 24 Aug 2018 13:48:59 +0000 (15:48 +0200)
commitad7f0ad1c3c9c541a4c315b24d4500405d1383ee
treec75da629bd6b53155ee0c08451a86f2688a7fa69
parentb083c8316b82b000b0fae6abad835b8003e9f08f
BUG/MEDIUM: mux_pt: dereference the connection with care in mux_pt_wake()

mux_pt_wake() calls data->wake() which can return -1 indicating that the
connection was just destroyed. We need to check for this condition and
immediately exit in this case otherwise we dereference a just freed
connection. Note that this mainly happens on idle connections between
two HTTP requests. It can have random implications between requests as
it may lead a wrong connection's polling to be re-enabled or disabled
for example, especially with threads.

This patch must be backported to 1.8.
src/mux_pt.c