BUG/MEDIUM: mux-h2: make sure not to move a dead connection to idle

In h2_detach(), it looks possible to place a dead connection back to
the idle list, and to later call h2_release() on it once detected as
dead. It's not certain that it happens but nothing in the code shows
it is not possible, so better make sure it cannot happen.

This should be preventively backported to all versions.

diff --git a/src/mux_h2.c b/src/mux_h2.c
index a5232d0ca715bc1de2e103e91c52631e6d3ef955..ab2e5bfe9cd7cf1b42e179bfbb082238ed52719f 100644 (file)
--- a/src/mux_h2.c
+++ b/src/mux_h2.c
@@ -5577,7 +5577,7 @@ static void h2_detach(struct sedesc *sd)
 
        h2s_destroy(h2s);
 
-       if (h2c->flags & H2_CF_IS_BACK) {
+       if (h2c->flags & H2_CF_IS_BACK && !h2c_is_dead(h2c)) {
                if (!(h2c->flags & (H2_CF_RCVD_SHUT|H2_CF_ERR_PENDING|H2_CF_ERROR))) {
                        /* Ensure idle-ping is activated before going to idle. */
                        if (eb_is_empty(&h2c->streams_by_id) &&