BUG/MEDIUM: stream: don't crash on out-of-memory

In case pool_alloc() fails in stream_new(), we try to detach the stream
from the list before it has been added, dereferencing a NULL. In order
to fix it, simply move the LIST_DEL call upwards.

This must be backported to 1.8.

diff --git a/src/stream.c b/src/stream.c
index a57879d861d9b966e733f882b214801282115130..42a6c48c97e89ceb4ac3f3510634e5b11b85aaa5 100644 (file)
--- a/src/stream.c
+++ b/src/stream.c
@@ -289,10 +289,10 @@ struct stream *stream_new(struct session *sess, enum obj_type *origin)
        flt_stream_release(s, 0);
        task_free(t);
        tasklet_free(s->si[1].wait_event.task);
+       LIST_DEL(&s->list);
 out_fail_alloc_si1:
        tasklet_free(s->si[0].wait_event.task);
  out_fail_alloc:
-       LIST_DEL(&s->list);
        pool_free(pool_head_stream, s);
        return NULL;
 }