From ffda58b5468ccb4d44e4bde87b3f79501264eb5e Mon Sep 17 00:00:00 2001 From: Olivier Houchard Date: Sun, 16 Dec 2018 01:29:11 +0100 Subject: [PATCH] BUG/MEDIUM: h2: Don't destroy the h2s if it still has a cs attached. In h2_deferred_shut, if we're done sending the shutr/shutw, don't destroy the h2s if it still has a conn_stream attached, or the conn_stream may try to access it again. --- src/mux_h2.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/mux_h2.c b/src/mux_h2.c index 6403b020c..dc28b12d0 100644 --- a/src/mux_h2.c +++ b/src/mux_h2.c @@ -3016,7 +3016,7 @@ static struct task *h2_deferred_shut(struct task *t, void *ctx, unsigned short s h2_do_shutr(h2s); if (h2s->st == H2_SS_CLOSED && - !((h2s->flags & (H2_SF_BLK_MBUSY | H2_SF_BLK_MROOM | H2_SF_BLK_MFCTL)))) + !((h2s->flags & (H2_SF_BLK_MBUSY | H2_SF_BLK_MROOM | H2_SF_BLK_MFCTL))) && !h2s->cs) h2s_destroy(h2s); return NULL; }