From: Olivier Houchard <cognet@ci0.org>
Date: Sun, 16 Dec 2018 00:29:11 +0000 (+0100)
Subject: BUG/MEDIUM: h2: Don't destroy the h2s if it still has a cs attached.
X-Git-Tag: v1.9-dev11~5
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=ffda58b5468ccb4d44e4bde87b3f79501264eb5e;p=thirdparty%2Fhaproxy.git

BUG/MEDIUM: h2: Don't destroy the h2s if it still has a cs attached.

In h2_deferred_shut, if we're done sending the shutr/shutw, don't destroy
the h2s if it still has a conn_stream attached, or the conn_stream may try
to access it again.
---

diff --git a/src/mux_h2.c b/src/mux_h2.c
index 6403b020c2..dc28b12d06 100644
--- a/src/mux_h2.c
+++ b/src/mux_h2.c
@@ -3016,7 +3016,7 @@ static struct task *h2_deferred_shut(struct task *t, void *ctx, unsigned short s
 		h2_do_shutr(h2s);
 
 	if (h2s->st == H2_SS_CLOSED &&
-	    !((h2s->flags & (H2_SF_BLK_MBUSY | H2_SF_BLK_MROOM | H2_SF_BLK_MFCTL))))
+	    !((h2s->flags & (H2_SF_BLK_MBUSY | H2_SF_BLK_MROOM | H2_SF_BLK_MFCTL))) && !h2s->cs)
 		h2s_destroy(h2s);
 	return NULL;
 }