tree 20a736a8f5bc6eb43f1c993069f56ec2374c2bdf
parent 3fd40935d91e315e95ba03304d46f9dffb3ff395
author Amaury Denoyelle <adenoyelle@haproxy.com> 1683634255 +0200
committer Amaury Denoyelle <adenoyelle@haproxy.com> 1683806691 +0200

BUG/MINOR: mux-quic: do not free frame already released by quic-conn

MUX uses qc_send_mux() function to send frames list over a QUIC
connection. On network congestion, the lower layer will reject some
frames and it is the MUX responsibility to free them. There is another
category of error which are when the sendto() fails. In this case, the
lower layer will free the packet and its attached frames and the MUX
should not touch them.

This model was violated by MUX layer for RESET_STREAM and STOP_SENDING
emission. In this case, frames were freed every time by the MUX on
error. This causes a double free error which lead to a crash.

Fix this by always ensuring if frames were rejected by the lower layer
before freeing them on the MUX. This is done simply by checking if frame
list is not empty, as RESET_STREAM and STOP_SENDING are sent
individually.

This bug was never reproduced in production. Thus, it is labelled as
MINOR.

This must be backported up to 2.7.