tree b052e963332a6e7bc2b2a31e4dd60438496d3b62
parent d8a44d0b243f7f7ab993e42a09401516eb18740b
author Willy Tarreau <w@1wt.eu> 1662057626 +0200
committer Willy Tarreau <w@1wt.eu> 1662110347 +0200
encoding latin1

BUG/MEDIUM: httpclient: always detach the caller before self-killing

If the caller dies before the server responds, the httpclient can crash
in hc_cli_res_end_cb() when unregistering because it dereferences
hc->caller which was already freed during the caller's unregistration.
The easiest way to reproduce it is by sending twice the following
request on the same CLI connection in expert mode, with httpterm
running on local port 8000:

   httpclient GET http://127.0.0.1:8000/?t=600

Note the 600ms delay that's larger than socat's default 500.

The code checks for a NULL everywhere hc->caller is used, but the NULL
was forgotten in this specific case. It must be placed in the second
half of httpclient_stop_and_destroy() which is responsible for signaling
the client that the caller leaves.

This must be backported to 2.6.