# HG changeset patch
# User Valentin Bartenev <vbart@nginx.com>
# Date 1390352299 -14400
# Node ID 03c198bb2acfbc1dee181629cd0f133d737a19c0
# Parent  905841c461fa9eecfe7e78f352c7a5a2479dcb6d
SPDY: fixed possible segfault.

While processing a DATA frame, the link to related stream is stored in spdy
connection object as part of connection state.  But this stream can be closed
between receiving parts of the frame.

diff --git a/src/http/ngx_http_spdy.c b/src/http/ngx_http_spdy.c
--- a/src/http/ngx_http_spdy.c
+++ b/src/http/ngx_http_spdy.c
@@ -2665,6 +2665,10 @@ ngx_http_spdy_close_stream(ngx_http_spdy
         }
     }
 
+    if (sc->stream == stream) {
+        sc->stream = NULL;
+    }
+
     if (stream->handled) {
         for (s = sc->last_stream; s; s = s->next) {
             if (s->next == stream) {