BUG/MEDIUM: h2: Don't destroy the h2s if it still has a cs attached.

In h2_deferred_shut, if we're done sending the shutr/shutw, don't destroy
the h2s if it still has a conn_stream attached, or the conn_stream may try
to access it again.

diff --git a/src/mux_h2.c b/src/mux_h2.c
index 6403b020c24f806e1152d72725f50601145aa3c9..dc28b12d065b1900526d9e522aaa3f77de046212 100644 (file)
--- a/src/mux_h2.c
+++ b/src/mux_h2.c
@@ -3016,7 +3016,7 @@ static struct task *h2_deferred_shut(struct task *t, void *ctx, unsigned short s
                h2_do_shutr(h2s);
 
        if (h2s->st == H2_SS_CLOSED &&
-           !((h2s->flags & (H2_SF_BLK_MBUSY | H2_SF_BLK_MROOM | H2_SF_BLK_MFCTL))))
+           !((h2s->flags & (H2_SF_BLK_MBUSY | H2_SF_BLK_MROOM | H2_SF_BLK_MFCTL))) && !h2s->cs)
                h2s_destroy(h2s);
        return NULL;
 }