From: Frédéric Lécaille <flecaille@haproxy.com>
Date: Thu, 10 Aug 2023 15:21:19 +0000 (+0200)
Subject: BUG/MINOR: quic: Possible crash in quic_cc_conn_io_cb() traces.
X-Git-Tag: v2.9-dev3~35
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=f3edbc792e41ce7d43ed267ca976fdf746a799c9;p=thirdparty%2Fhaproxy.git

BUG/MINOR: quic: Possible crash in quic_cc_conn_io_cb() traces.

Reset the local cc_qc and qc after having released cc_qc. Note that
cc_qc == qc. This is required to prevent haproxy from crashing
when TRACE_LEAVE() is called.

No need to backport.
---

diff --git a/src/quic_conn.c b/src/quic_conn.c
index ba4ab5ce9a..6751b360e9 100644
--- a/src/quic_conn.c
+++ b/src/quic_conn.c
@@ -798,6 +798,8 @@ static struct task *quic_cc_conn_io_cb(struct task *t, void *context, unsigned i
 	if (qc_snd_buf(qc, &buf, buf.data, 0) < 0) {
 		TRACE_ERROR("sendto fatal error", QUIC_EV_CONN_IO_CB, qc);
 		quic_release_cc_conn(cc_qc);
+		cc_qc = NULL;
+		qc = NULL;
 		goto leave;
 	}