tree c75da629bd6b53155ee0c08451a86f2688a7fa69
parent b083c8316b82b000b0fae6abad835b8003e9f08f
author Willy Tarreau <w@1wt.eu> 1535118539 +0200
committer Willy Tarreau <w@1wt.eu> 1535118539 +0200
encoding latin1

BUG/MEDIUM: mux_pt: dereference the connection with care in mux_pt_wake()

mux_pt_wake() calls data->wake() which can return -1 indicating that the
connection was just destroyed. We need to check for this condition and
immediately exit in this case otherwise we dereference a just freed
connection. Note that this mainly happens on idle connections between
two HTTP requests. It can have random implications between requests as
it may lead a wrong connection's polling to be re-enabled or disabled
for example, especially with threads.

This patch must be backported to 1.8.