From: mildis <me@mildis.org>
Date: Tue, 2 Oct 2018 14:44:18 +0000 (+0200)
Subject: BUG/MINOR: h2: null-deref
X-Git-Tag: v1.9-dev4~74
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=cd2d7de44efd3675b5f988dff1ced6843e30b46e;p=thirdparty%2Fhaproxy.git

BUG/MINOR: h2: null-deref

h2c can be null if pool_alloc() failed.
Bypass tasklet_free and pool_free if pool_alloc did fail.
---

diff --git a/src/mux_h2.c b/src/mux_h2.c
index 206ecb8f29..558375433c 100644
--- a/src/mux_h2.c
+++ b/src/mux_h2.c
@@ -356,7 +356,7 @@ static int h2c_frt_init(struct connection *conn)
 
 	h2c = pool_alloc(pool_head_h2c);
 	if (!h2c)
-		goto fail;
+		goto fail_no_h2c;
 
 
 	h2c->shut_timeout = h2c->timeout = sess->fe->timeout.client;
@@ -420,12 +420,13 @@ static int h2c_frt_init(struct connection *conn)
 	conn_xprt_want_recv(conn);
 	tasklet_wakeup(h2c->wait_list.task);
 	return 0;
- fail:
+  fail:
 	if (t)
 		task_free(t);
 	if (h2c->wait_list.task)
 		tasklet_free(h2c->wait_list.task);
 	pool_free(pool_head_h2c, h2c);
+  fail_no_h2c:
 	return -1;
 }