tree fa17704d011a0636d883f7c7184e9a7f1ea87df0
parent 6b3b0d4736f2e27cbbcd2f8f94edad3a1fb1c574
author Willy Tarreau <w@1wt.eu> 1350938875 +0200
committer Willy Tarreau <w@1wt.eu> 1350938875 +0200

BUG/MAJOR: connection: risk of crash on certain tricky close scenario

In some circumstances, if the connection to the server is aborted while
some data were planned to be sent and the poller reported an ability to
send, then conn_fd_handler() would still call conn->data->send(), causing
the data layer to dereference the now NULL conn->xprt and crash.

So we have to check for conn->xprt validity before calling the data
layer.

This issue was introduced after 1.5-dev12 so it does not need any backport
and does not affect any released version.

Special thanks go to Cristian Ditoiu who once again provided amazing help
to troubleshoot this bug !