Mercurial > hg > nginx

changeset 9210:4ed4e1e7f115

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
QUIC: fixed stream cleanup (ticket #2586). Stream connection cleanup handler ngx_quic_stream_cleanup_handler() calls ngx_quic_shutdown_stream() after which it resets the pointer from quic stream to the connection (sc->connection = NULL). Previously if this call failed, sc->connection retained the old value, while the connection was freed by the application code. This resulted later in a second attempt to close the freed connection, which lead to allocator double free error. The fix is to reset the sc->connection pointer in case of error.
author Roman Arutyunyan <arut@nginx.com>
date Wed, 14 Feb 2024 15:55:37 +0400
parents 1bf1b423f268
children 0d9e536ec628
files src/event/quic/ngx_event_quic_streams.c
diffstat 1 files changed, 1 insertions(+), 0 deletions(-) [+]
line wrap: on
line diff
--- a/src/event/quic/ngx_event_quic_streams.c
+++ b/src/event/quic/ngx_event_quic_streams.c
@@ -1097,6 +1097,7 @@ ngx_quic_stream_cleanup_handler(void *da
                    "quic stream id:0x%xL cleanup", qs->id);
 
     if (ngx_quic_shutdown_stream(c, NGX_RDWR_SHUTDOWN) != NGX_OK) {
+        qs->connection = NULL;
         goto failed;
     }