From 71d7fbebe14e5473331591d74ed9dd18ce5323e6 Mon Sep 17 00:00:00 2001 From: mildis Date: Tue, 2 Oct 2018 16:44:18 +0200 Subject: [PATCH] BUG/MINOR: h2: null-deref h2c can be null if pool_alloc() failed. Bypass tasklet_free and pool_free if pool_alloc did fail. --- src/mux_h2.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/src/mux_h2.c b/src/mux_h2.c index 61603811..d3575fe2 100644 --- a/src/mux_h2.c +++ b/src/mux_h2.c @@ -359,7 +359,7 @@ static int h2c_frt_init(struct connection *conn) h2c = pool_alloc(pool_head_h2c); if (!h2c) - goto fail; + goto fail_no_h2c; h2c->shut_timeout = h2c->timeout = sess->fe->timeout.client; @@ -424,12 +424,13 @@ static int h2c_frt_init(struct connection *conn) if (h2_recv(h2c)) h2_process(h2c); return 0; - fail: + fail: if (t) task_free(t); if (h2c->wait_list.task) tasklet_free(h2c->wait_list.task); pool_free(pool_head_h2c, h2c); + fail_no_h2c: return -1; } -- 2.19.0