BUG/MEDIUM: quic: fix crash on CC if mux not present

If a CONNECTION_CLOSE is received during handshake or after mux release,
a segfault happens due to invalid dereferencement of qc->qcc. Check
mux_state first to prevent this.

diff --git a/src/xprt_quic.c b/src/xprt_quic.c
index bff17805c5d20f4f594f9e969fb033cc1d61fa06..b71e427220f4ea013d017a2a05bedc6cfe843e55 100644 (file)
--- a/src/xprt_quic.c
+++ b/src/xprt_quic.c
@@ -2448,7 +2448,8 @@ static int qc_parse_pkt_frms(struct quic_rx_packet *pkt, struct ssl_sock_ctx *ct
                case QUIC_FT_CONNECTION_CLOSE:
                case QUIC_FT_CONNECTION_CLOSE_APP:
                        /* warn the mux to close the connection */
-                       qc->qcc->flags |= QC_CF_CC_RECV;
+                       if (qc->mux_state == QC_MUX_READY)
+                               qc->qcc->flags |= QC_CF_CC_RECV;
                        tasklet_wakeup(qc->qcc->wait_event.tasklet);
                        break;
                case QUIC_FT_HANDSHAKE_DONE: