BUG/MAJOR: mux_pt: don't dereference a connstream after ->wake()

The wake() callback may destroy a connstream, so it must not be
dereferenced in case wake() returns negative. No backport needed,
this is 1.8-only.

diff --git a/src/mux_pt.c b/src/mux_pt.c
index 479f831c69b67215a692f987f6cf88debae6ec95..cd3a28b42a10245217fce9d2356cd52c144054d6 100644 (file)
--- a/src/mux_pt.c
+++ b/src/mux_pt.c
@@ -51,8 +51,9 @@ static int mux_pt_wake(struct connection *conn)
 
        ret = cs->data_cb->wake ? cs->data_cb->wake(cs) : 0;
 
-       cs_update_mux_polling(cs);
-       return (ret);
+       if (ret >= 0)
+               cs_update_mux_polling(cs);
+       return ret;
 }
 
 /* callback used to update the mux's polling flags after changing a cs' status.