Author: rhuijben Date: Sat Nov 28 22:26:18 2015 New Revision: 1717007 URL: http://svn.apache.org/viewvc?rev=1717007&view=rev Log: When sending a bit of data, start by clearing the remaining data and only set it when there is still remaining after processing. This solves one case where data remained queued, causing an abort() via double free.
* protocols/http2_stream.c (stream_send_data): Never send and keep the same data tail. Always ensure that we need to write if we leave a tail. Modified: serf/trunk/protocols/http2_stream.c Modified: serf/trunk/protocols/http2_stream.c URL: http://svn.apache.org/viewvc/serf/trunk/protocols/http2_stream.c?rev=1717007&r1=1717006&r2=1717007&view=diff ============================================================================== --- serf/trunk/protocols/http2_stream.c (original) +++ serf/trunk/protocols/http2_stream.c Sat Nov 28 22:26:18 2015 @@ -226,6 +226,7 @@ static apr_status_t stream_send_data(ser /* Sending DATA frames over HTTP/2 is not easy as this usually requires handling windowing, priority, etc. This code will improve over time */ + stream->data->data_tail = NULL; if (!data) remaining = 0; @@ -246,7 +247,6 @@ static apr_status_t stream_send_data(ser &stream->streamid, serf_http2__allocate_stream_id, stream, 0, stream->alloc); - stream->data->data_tail = NULL; return serf_http2__enqueue_frame(stream->h2, next, false); }