SPDY: fixed possible segfault.

While processing a DATA frame, the link to related stream is stored in spdy
connection object as part of connection state.  But this stream can be closed
between receiving parts of the frame.

diff --git a/src/http/ngx_http_spdy.c b/src/http/ngx_http_spdy.c
index a01e0b100ee3b6d5bf353e1a2e4b130c382b3215..bfed97bdc8e9e5f662317509c853bf4dcf830d51 100644 (file)
--- a/src/http/ngx_http_spdy.c
+++ b/src/http/ngx_http_spdy.c
@@ -2665,6 +2665,10 @@ ngx_http_spdy_close_stream(ngx_http_spdy_stream_t *stream, ngx_int_t rc)
         }
     }
 
+    if (sc->stream == stream) {
+        sc->stream = NULL;
+    }
+
     if (stream->handled) {
         for (s = sc->last_stream; s; s = s->next) {
             if (s->next == stream) {