Fix a crash in the client-side DoH code (header processing callback)

Support a situation in header processing callback when client side
code could receive a belated response or part of it. That could
happen when the HTTP/2 session was already closed, but there were some
response data from server in flight. Other client-side nghttp2
callbacks code already handled this case.

The bug became apparent after HTTP/2 write buffering was supported,
leading to rare unit test failures.

diff --git a/lib/isc/netmgr/http.c b/lib/isc/netmgr/http.c
index 502cc240dafb5c91bf4bdca5ebf7be98bb7bcf29..e9285639ccf24f9ebdb776007100c33be71c81de 100644 (file)
--- a/lib/isc/netmgr/http.c
+++ b/lib/isc/netmgr/http.c
@@ -696,12 +696,22 @@ client_on_header_callback(nghttp2_session *ngsession,
 
        REQUIRE(VALID_HTTP2_SESSION(session));
        REQUIRE(session->client);
-       REQUIRE(!ISC_LIST_EMPTY(session->cstreams));
 
        UNUSED(flags);
        UNUSED(ngsession);
 
        cstream = find_http_cstream(frame->hd.stream_id, session);
+       if (cstream == NULL) {
+               /*
+                * This could happen in two cases:
+                * - the server sent us bad data, or
+                * - we closed the session prematurely before receiving all
+                *   responses (i.e., because of a belated or partial response).
+                */
+               return (NGHTTP2_ERR_CALLBACK_FAILURE);
+       }
+
+       INSIST(!ISC_LIST_EMPTY(session->cstreams));
 
        switch (frame->hd.type) {
        case NGHTTP2_HEADERS: