BUG/MINOR: haload: fix use-after-free upon updating task expiration

Fix a bug in hld_strm_task() where hs was accessed after it had already been
freed via hldstream_free(&hs). The task expiration update and queueing
now safely rely on <usr> rather than <hs->usr>.

diff --git a/src/haload.c b/src/haload.c
index 6057d7978fd74ce7fcc259009a40b976e577470d..638acdba87956594b7ea0a5e0f9a6189dd77d65c 100644 (file)
--- a/src/haload.c
+++ b/src/haload.c
@@ -1290,8 +1290,8 @@ struct task *hld_strm_task(struct task *t, void *context, unsigned int state)
                 * is also the stream with the oldest expiration time.
                 */
                first_hs = LIST_ELEM(usr->strms.n, struct hldstream *, list);
-               hs->usr->task->expire = first_hs->expire;
-               task_queue(hs->usr->task);
+               usr->task->expire = first_hs->expire;
+               task_queue(usr->task);
        }
 
        goto leave;