]> git.kaiwu.me - nginx.git/commit
QUIC: fixed accessing a released stream.
authorRoman Arutyunyan <arut@nginx.com>
Tue, 10 Dec 2024 14:19:27 +0000 (18:19 +0400)
committerRoman Arutyunyan <arutyunyan.roman@gmail.com>
Fri, 27 Dec 2024 12:14:14 +0000 (16:14 +0400)
commite3a9b6ad08a86e799a3d77da3f2fc507d3c9699e
treeb93634403af49e4844bb1539e4fe005ba21f3702
parenta52ba8ba0e349585e49073c168e423c12abcf597
QUIC: fixed accessing a released stream.

While trying to close a stream in ngx_quic_close_streams() by calling its
read event handler, the next stream saved prior to that could be destroyed
recursively.  This caused a segfault while trying to access the next stream.

The way the next stream could be destroyed in HTTP/3 is the following.
A request stream read event handler ngx_http_request_handler() could
end up calling ngx_http_v3_send_cancel_stream() to report a cancelled
request stream in the decoder stream.  If sending stream cancellation
decoder instruction fails for any reason, and the decoder stream is the
next in order after the request stream, the issue is triggered.

The fix is to postpone calling read event handlers for all streams being
closed to avoid closing a released stream.
src/event/quic/ngx_event_quic_streams.c