BUG/MEDIUM: h2: Make sure we're not already in the send_list in h2_subscribe().

In h2_subscribe(), don't add ourself to the send_list if we're already in it.
That may happen if we try to send and fail twice, as we're only removed
from the send_list if we managed to send data, to promote fairness.
Failing to do so can lead to either an infinite loop, or some random crashes,
as we'd get the same h2s in the send_list twice.

This should be backported to 1.9.

diff --git a/src/mux_h2.c b/src/mux_h2.c
index adcd0b4df70279543448a29af74b0e98542c60c3..685d5838550671ada80789e9c36cbd237815df59 100644 (file)
--- a/src/mux_h2.c
+++ b/src/mux_h2.c
@@ -5150,7 +5150,8 @@ static int h2_subscribe(struct conn_stream *cs, int event_type, void *param)
                        sw->events |= SUB_RETRY_SEND;
                        sw->handle = h2s;
                        h2s->send_wait = sw;
-                       if (!(h2s->flags & H2_SF_BLK_SFCTL)) {
+                       if (!(h2s->flags & H2_SF_BLK_SFCTL) &&
+                           LIST_ISEMPTY(&h2s->list)) {
                                if (h2s->flags & H2_SF_BLK_MFCTL)
                                        LIST_ADDQ(&h2c->fctl_list, &h2s->list);
                                else