From: W.C.A. Wijngaards <wouter@nlnetlabs.nl>
Date: Fri, 12 Jul 2024 14:11:29 +0000 (+0200)
Subject: - Fix #1103: unbound 1.20.0 segmentation fault with nghttp2.
X-Git-Tag: release-1.21.0rc1~30
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=3adb9c8f92ba1e26bbe73da38ab0c471044c3a85;p=thirdparty%2Funbound.git

- Fix #1103: unbound 1.20.0 segmentation fault with nghttp2.
---

diff --git a/doc/Changelog b/doc/Changelog
index 14a72306c..bc71af26d 100644
--- a/doc/Changelog
+++ b/doc/Changelog
@@ -1,6 +1,9 @@
 12 July 2024: Yorgos
 	- Add RPZ tag tests in acl_interface.tdir.
 
+12 July 2024: Wouter
+	- Fix #1103: unbound 1.20.0 segmentation fault with nghttp2.
+
 10 July 2024: Wouter
 	- For #773: In contrib/unbound.service.in set unbound to start after
 	  network-online.target. Also for contrib/unbound_portable.service.in.
diff --git a/services/mesh.c b/services/mesh.c
index 9797c7526..d3811b475 100644
--- a/services/mesh.c
+++ b/services/mesh.c
@@ -1576,6 +1576,10 @@ void mesh_query_done(struct mesh_state* mstate)
 				tcp_req_info_remove_mesh_state(r->query_reply.c->tcp_req_info, mstate);
 				r_buffer = NULL;
 			}
+			if(r->query_reply.c->use_h2) {
+				http2_stream_remove_mesh_state(
+					r->query_reply.c->h2_stream);
+			}
 			prev = r;
 			prev_buffer = r_buffer;
 		}
@@ -2284,6 +2288,9 @@ mesh_serve_expired_callback(void* arg)
 			r, r_buffer, prev, prev_buffer);
 		if(r->query_reply.c->tcp_req_info)
 			tcp_req_info_remove_mesh_state(r->query_reply.c->tcp_req_info, mstate);
+		if(r->query_reply.c->use_h2)
+			http2_stream_remove_mesh_state(
+				r->query_reply.c->h2_stream);
 		infra_wait_limit_dec(mstate->s.env->infra_cache,
 			&r->query_reply, mstate->s.env->cfg);
 		prev = r;
diff --git a/testcode/fake_event.c b/testcode/fake_event.c
index 09269289d..f02a98351 100644
--- a/testcode/fake_event.c
+++ b/testcode/fake_event.c
@@ -1978,4 +1978,8 @@ void http2_stream_add_meshstate(struct http2_stream* ATTR_UNUSED(h2_stream),
 {
 }
 
+void http2_stream_remove_mesh_state(struct http2_stream* ATTR_UNUSED(h2_stream))
+{
+}
+
 /*********** End of Dummy routines ***********/
diff --git a/util/netevent.c b/util/netevent.c
index 3663144b2..dc5fd63fa 100644
--- a/util/netevent.c
+++ b/util/netevent.c
@@ -3307,6 +3307,13 @@ void http2_stream_add_meshstate(struct http2_stream* h2_stream,
 	h2_stream->mesh_state = m;
 }
 
+void http2_stream_remove_mesh_state(struct http2_stream* h2_stream)
+{
+	if(!h2_stream)
+		return;
+	h2_stream->mesh_state = NULL;
+}
+
 /** delete http2 session server. After closing connection. */
 static void http2_session_server_delete(struct http2_session* h2_session)
 {
diff --git a/util/netevent.h b/util/netevent.h
index 1e4a13f9b..6f43ce56c 100644
--- a/util/netevent.h
+++ b/util/netevent.h
@@ -955,6 +955,9 @@ void http2_session_add_stream(struct http2_session* h2_session,
 void http2_stream_add_meshstate(struct http2_stream* h2_stream,
 	struct mesh_area* mesh, struct mesh_state* m);
 
+/** Remove mesh state from stream. When the mesh state has been removed. */
+void http2_stream_remove_mesh_state(struct http2_stream* h2_stream);
+
 /**
  * This routine is published for checks and tests, and is only used internally.
  * handle libevent callback for timer comm.