From: Willy Tarreau <w@1wt.eu>
Date: Wed, 3 Oct 2018 16:27:52 +0000 (+0200)
Subject: BUG/MEDIUM: h2: make h2_stream_new() return an error on memory allocation failure
X-Git-Tag: v1.9-dev4~87
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=45efc07cb5a4cd33a3ef0808e43f3440ad1d6368;p=thirdparty%2Fhaproxy.git

BUG/MEDIUM: h2: make h2_stream_new() return an error on memory allocation failure

Commit 8ae735da0 ("MEDIUM: mux_h2: Revamp the send path when blocking.")
added a tasklet allocation in h2_stream_new(), however the error exit path
fails to reset h2s in case the tasklet cannot be allocated, resulting in
the h2s pointer to be returned as valid to the caller. Let's readjust the
exit path to always return NULL on error and to always log as well (since
there is no reason for not logging on such important errors).

No backport is needed, this is strictly 1.9-dev.
---

diff --git a/src/mux_h2.c b/src/mux_h2.c
index 62eb909b39..2839ea16ae 100644
--- a/src/mux_h2.c
+++ b/src/mux_h2.c
@@ -684,10 +684,9 @@ static struct h2s *h2c_stream_new(struct h2c *h2c, int id)
 		goto out;
 
 	h2s->wait_list.task = tasklet_new();
-	if (!h2s->wait_list.task) {
-		pool_free(pool_head_h2s, h2s);
-		goto out;
-	}
+	if (!h2s->wait_list.task)
+		goto out_free_h2s;
+
 	LIST_INIT(&h2s->wait_list.list);
 	h2s->recv_wait_list = NULL;
 	h2s->wait_list.task->process = h2_deferred_shut;
@@ -743,9 +742,11 @@ static struct h2s *h2c_stream_new(struct h2c *h2c, int id)
  out_close:
 	h2s_destroy(h2s);
 	h2s = NULL;
-	sess_log(sess);
+ out_free_h2s:
+	pool_free(pool_head_h2s, h2s);
  out:
-	return h2s;
+	sess_log(sess);
+	return NULL;
 }
 
 /* try to send a settings frame on the connection. Returns > 0 on success, 0 if