]> git.kaiwu.me - nginx.git/commit
QUIC: fixed accessing a released stream.
authorRoman Arutyunyan <arut@nginx.com>
Tue, 10 Dec 2024 14:19:27 +0000 (18:19 +0400)
committerpluknet <pluknet@nginx.com>
Wed, 5 Feb 2025 16:40:47 +0000 (20:40 +0400)
commit5c8a92f1f0e482028504e5340f0ba455423df336
treeaba2f5d8c9cbac768b9026a71c29999a5b26af47
parent0d11f2885eab99924dbe40d7effb91c80b00d9bf
QUIC: fixed accessing a released stream.

While trying to close a stream in ngx_quic_close_streams() by calling its
read event handler, the next stream saved prior to that could be destroyed
recursively.  This caused a segfault while trying to access the next stream.

The way the next stream could be destroyed in HTTP/3 is the following.
A request stream read event handler ngx_http_request_handler() could
end up calling ngx_http_v3_send_cancel_stream() to report a cancelled
request stream in the decoder stream.  If sending stream cancellation
decoder instruction fails for any reason, and the decoder stream is the
next in order after the request stream, the issue is triggered.

The fix is to postpone calling read event handlers for all streams being
closed to avoid closing a released stream.
src/event/quic/ngx_event_quic_streams.c