BUG/MINOR: mux-h1: don't dereference a NULL opposite sedesc in h1_fastfwd()

In h1_fastfwd(), when the opposite stream endpoint descriptor cannot be
retrieved, the function jumps to the "out" label, which unconditionally
dereferences <sdo> (iobuf flags and se_done_ff()), leading to a NULL pointer
dereference.

It is probably not reachable today, because fast-forwarding is only
attempted when the opposite endpoint announced it can consume fast-forwarded
data, which implies both sides are linked. But the error path is wrong
anyway. Now the fast-forwarding is aborted in this case, like when nothing
can be done, so that the regular receive path is used instead.

This patch may be backported as far as 3.0 if needed.

diff --git a/src/mux_h1.c b/src/mux_h1.c
index e24fd26f1304c8cd88835767c2475e62fa12928e..c38d9ad19cca04446d293f9dcb2b1c67f1538733 100644 (file)
--- a/src/mux_h1.c
+++ b/src/mux_h1.c
@@ -5346,8 +5346,10 @@ static int h1_fastfwd(struct stconn *sc, unsigned int count, unsigned int flags)
 
        sdo = h1s_opposite_sd(h1s);
        if (!sdo) {
+               /* Note: <sdo> is dereferenced in the "out" path */
+               h1c->flags &= ~H1C_F_WANT_FASTFWD;
                TRACE_STATE("Opposite endpoint not available yet", H1_EV_STRM_RECV, h1c->conn, h1s);
-               goto out;
+               goto end;
        }
 
   retry: