tree 6d1ab4c0c78eff4ba1935dd8b108eb9937b21d27
parent 9ab2fb39215243ad33362ddc82309a0494867cf7
author Willy Tarreau <w@1wt.eu> 1642004666 +0100
committer Willy Tarreau <w@1wt.eu> 1642005061 +0100
encoding latin1

BUG/MEDIUM: connection: properly leave stopping list on error

The stopping-list management introduced by commit d3a88c1c3 ("MEDIUM:
connection: close front idling connection on soft-stop") missed two
error paths in the H1 and H2 muxes. The effect is that if a stream
or HPACK table couldn't be allocated for these incoming connections,
we would leave with the connection freed still attached to the
stopping_list and it would never leave it, resulting in use-after-free
hence either a crash or a data corruption.

This is marked as medium as it only happens under extreme memory pressure
or when playing with tune.fail-alloc. Other stability issues remain in
such a case so that abnormal behaviors cannot be explained by this bug
alone.

This must be backported to 2.4.