BUG/MINOR: quic: Unchecked pointer to Handshake packet number space

It is possible that there are still Initial crypto data in flight without
Handshake crypto data in flight. This is very rare but possible.

This issue was reported by handshakeloss interop test with quic-go as client
and @chipitsine in GH #2279.

No need to backport.

diff --git a/src/quic_tx.c b/src/quic_tx.c
index 46dd6bad87ecdffff8d908ae861ae5c3b203b29e..67c57efb5791bfa183f0333cd128289e4eed16af 100644 (file)
--- a/src/quic_tx.c
+++ b/src/quic_tx.c
@@ -1333,7 +1333,8 @@ int qc_dgrams_retransmit(struct quic_conn *qc)
                                if (!LIST_ISEMPTY(&hfrms))
                                        hpktns->tx.pto_probe = 1;
                                qc->iel->retrans_frms = &ifrms;
-                               qc->hel->retrans_frms = &hfrms;
+                               if (qc->hel)
+                                       qc->hel->retrans_frms = &hfrms;
                                if (!qc_send_hdshk_pkts(qc, 1, qc->iel, qc->hel))
                                        goto leave;
                                /* Put back unsent frames in their packet number spaces */