BUG/MEDIUM: mux-fcgi: Use a safe loop to resume each stream eligible for sending

At the end of fcgi_send(), if the connection is not full anymore, we loop on
the send list to resume FCGI stream for sending. But a streams may be
removed from the this list during the loop. So a safe loop must be used.

This patch should be backported to all stable versions.

diff --git a/src/mux_fcgi.c b/src/mux_fcgi.c
index 33153fffadbf3aa24b34f513992aafa48ba9be4f..5f84b1183fed709a0076e6713a83062ea948eb53 100644 (file)
--- a/src/mux_fcgi.c
+++ b/src/mux_fcgi.c
@@ -2987,9 +2987,9 @@ static int fcgi_send(struct fcgi_conn *fconn)
         * for us.
         */
        if (!(fconn->flags & (FCGI_CF_MUX_MFULL | FCGI_CF_DEM_MROOM)) && fconn->state >= FCGI_CS_RECORD_H) {
-               struct fcgi_strm *fstrm;
+               struct fcgi_strm *fstrm, *fstrm_back;
 
-               list_for_each_entry(fstrm, &fconn->send_list, send_list) {
+               list_for_each_entry_safe(fstrm, fstrm_back, &fconn->send_list, send_list) {
                        if (fconn->state == FCGI_CS_CLOSED || fconn->flags & FCGI_CF_MUX_BLOCK_ANY)
                                break;