From: Christopher Faulet <cfaulet@haproxy.com>
Date: Thu, 5 Mar 2026 13:18:41 +0000 (+0100)
Subject: BUG/MEDIUM: mux-fcgi: Use a safe loop to resume each stream eligible for sending
X-Git-Tag: v3.4-dev6~7
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=9b22f22858a2af3a6a5b36ea5c079ebd084d44fc;p=thirdparty%2Fhaproxy.git

BUG/MEDIUM: mux-fcgi: Use a safe loop to resume each stream eligible for sending

At the end of fcgi_send(), if the connection is not full anymore, we loop on
the send list to resume FCGI stream for sending. But a streams may be
removed from the this list during the loop. So a safe loop must be used.

This patch should be backported to all stable versions.
---

diff --git a/src/mux_fcgi.c b/src/mux_fcgi.c
index 33153fffa..5f84b1183 100644
--- a/src/mux_fcgi.c
+++ b/src/mux_fcgi.c
@@ -2987,9 +2987,9 @@ static int fcgi_send(struct fcgi_conn *fconn)
 	 * for us.
 	 */
 	if (!(fconn->flags & (FCGI_CF_MUX_MFULL | FCGI_CF_DEM_MROOM)) && fconn->state >= FCGI_CS_RECORD_H) {
-		struct fcgi_strm *fstrm;
+		struct fcgi_strm *fstrm, *fstrm_back;
 
-		list_for_each_entry(fstrm, &fconn->send_list, send_list) {
+		list_for_each_entry_safe(fstrm, fstrm_back, &fconn->send_list, send_list) {
 			if (fconn->state == FCGI_CS_CLOSED || fconn->flags & FCGI_CF_MUX_BLOCK_ANY)
 				break;