Author: rhuijben
Date: Sat Nov 28 22:26:18 2015
New Revision: 1717007

URL: http://svn.apache.org/viewvc?rev=1717007&view=rev
Log:
When sending a bit of data, start by clearing the remaining data and
only set it when there is still remaining after processing. This
solves one case where data remained queued, causing an abort() via
double free.

* protocols/http2_stream.c
  (stream_send_data): Never send and keep the same data tail. Always
    ensure that we need to write if we leave a tail.

Modified:
    serf/trunk/protocols/http2_stream.c

Modified: serf/trunk/protocols/http2_stream.c
URL: 
http://svn.apache.org/viewvc/serf/trunk/protocols/http2_stream.c?rev=1717007&r1=1717006&r2=1717007&view=diff
==============================================================================
--- serf/trunk/protocols/http2_stream.c (original)
+++ serf/trunk/protocols/http2_stream.c Sat Nov 28 22:26:18 2015
@@ -226,6 +226,7 @@ static apr_status_t stream_send_data(ser
 
     /* Sending DATA frames over HTTP/2 is not easy as this usually requires
        handling windowing, priority, etc. This code will improve over time */
+    stream->data->data_tail = NULL;
 
     if (!data)
         remaining = 0;
@@ -246,7 +247,6 @@ static apr_status_t stream_send_data(ser
                                                &stream->streamid,
                                                serf_http2__allocate_stream_id,
                                                stream, 0, stream->alloc);
-        stream->data->data_tail = NULL;
         return serf_http2__enqueue_frame(stream->h2, next, false);
     }
 


Reply via email to