Skip to content

Commit

Permalink
QUIC: fixed stream cleanup (ticket #2586).
Browse files Browse the repository at this point in the history
Stream connection cleanup handler ngx_quic_stream_cleanup_handler() calls
ngx_quic_shutdown_stream() after which it resets the pointer from quic stream
to the connection (sc->connection = NULL).  Previously if this call failed,
sc->connection retained the old value, while the connection was freed by the
application code.  This resulted later in a second attempt to close the freed
connection, which lead to allocator double free error.

The fix is to reset the sc->connection pointer in case of error.
  • Loading branch information
arut committed Feb 14, 2024
1 parent 5902baf commit 5818f8a
Showing 1 changed file with 1 addition and 0 deletions.
1 change: 1 addition & 0 deletions src/event/quic/ngx_event_quic_streams.c
Original file line number Diff line number Diff line change
Expand Up @@ -1097,6 +1097,7 @@ ngx_quic_stream_cleanup_handler(void *data)
"quic stream id:0x%xL cleanup", qs->id);

if (ngx_quic_shutdown_stream(c, NGX_RDWR_SHUTDOWN) != NGX_OK) {
qs->connection = NULL;
goto failed;
}

Expand Down

0 comments on commit 5818f8a

Please sign in to comment.