From 32826466f511741f22975b8e53bb502bc4fbd391 Mon Sep 17 00:00:00 2001
From: Tatsuhiro Tsujikawa <tatsuhiro.t@gmail.com>
Date: Fri, 24 Aug 2018 23:07:16 +0900
Subject: [PATCH] nghttpx: Fix crash with API request

---
 src/shrpx_downstream.cc     | 18 ++++++++++------
 src/shrpx_http2_upstream.cc | 42 ++++++++++++++++++++-----------------
 src/shrpx_https_upstream.cc | 32 +++++++++++++++-------------
 3 files changed, 53 insertions(+), 39 deletions(-)

diff --git a/src/shrpx_downstream.cc b/src/shrpx_downstream.cc
index 56901ff0..d344ef15 100644
--- a/src/shrpx_downstream.cc
+++ b/src/shrpx_downstream.cc
@@ -191,8 +191,10 @@ Downstream::~Downstream() {
 #ifdef HAVE_MRUBY
   if (dconn_) {
     const auto &group = dconn_->get_downstream_addr_group();
-    const auto &mruby_ctx = group->mruby_ctx;
-    mruby_ctx->delete_downstream(this);
+    if (group) {
+      const auto &mruby_ctx = group->mruby_ctx;
+      mruby_ctx->delete_downstream(this);
+    }
   }
 #endif // HAVE_MRUBY
 
@@ -227,8 +229,10 @@ void Downstream::detach_downstream_connection() {
 
 #ifdef HAVE_MRUBY
   const auto &group = dconn_->get_downstream_addr_group();
-  const auto &mruby_ctx = group->mruby_ctx;
-  mruby_ctx->delete_downstream(this);
+  if (group) {
+    const auto &mruby_ctx = group->mruby_ctx;
+    mruby_ctx->delete_downstream(this);
+  }
 #endif // HAVE_MRUBY
 
   dconn_->detach_downstream(this);
@@ -250,8 +254,10 @@ std::unique_ptr<DownstreamConnection> Downstream::pop_downstream_connection() {
   }
 
   const auto &group = dconn_->get_downstream_addr_group();
-  const auto &mruby_ctx = group->mruby_ctx;
-  mruby_ctx->delete_downstream(this);
+  if (group) {
+    const auto &mruby_ctx = group->mruby_ctx;
+    mruby_ctx->delete_downstream(this);
+  }
 #endif // HAVE_MRUBY
 
   return std::unique_ptr<DownstreamConnection>(dconn_.release());
diff --git a/src/shrpx_http2_upstream.cc b/src/shrpx_http2_upstream.cc
index df7a751c..fdf988cc 100644
--- a/src/shrpx_http2_upstream.cc
+++ b/src/shrpx_http2_upstream.cc
@@ -480,19 +480,21 @@ void Http2Upstream::initiate_downstream(Downstream *downstream) {
 
 #ifdef HAVE_MRUBY
   const auto &group = dconn_ptr->get_downstream_addr_group();
-  const auto &mruby_ctx = group->mruby_ctx;
-  if (mruby_ctx->run_on_request_proc(downstream) != 0) {
-    if (error_reply(downstream, 500) != 0) {
-      rst_stream(downstream, NGHTTP2_INTERNAL_ERROR);
+  if (group) {
+    const auto &mruby_ctx = group->mruby_ctx;
+    if (mruby_ctx->run_on_request_proc(downstream) != 0) {
+      if (error_reply(downstream, 500) != 0) {
+        rst_stream(downstream, NGHTTP2_INTERNAL_ERROR);
+      }
+
+      downstream_queue_.mark_failure(downstream);
+
+      return;
     }
 
-    downstream_queue_.mark_failure(downstream);
-
-    return;
-  }
-
-  if (downstream->get_response_state() == Downstream::MSG_COMPLETE) {
-    return;
+    if (downstream->get_response_state() == Downstream::MSG_COMPLETE) {
+      return;
+    }
   }
 #endif // HAVE_MRUBY
 
@@ -1635,18 +1637,20 @@ int Http2Upstream::on_downstream_header_complete(Downstream *downstream) {
   if (!downstream->get_non_final_response()) {
     auto dconn = downstream->get_downstream_connection();
     const auto &group = dconn->get_downstream_addr_group();
-    const auto &dmruby_ctx = group->mruby_ctx;
+    if (group) {
+      const auto &dmruby_ctx = group->mruby_ctx;
 
-    if (dmruby_ctx->run_on_response_proc(downstream) != 0) {
-      if (error_reply(downstream, 500) != 0) {
+      if (dmruby_ctx->run_on_response_proc(downstream) != 0) {
+        if (error_reply(downstream, 500) != 0) {
+          return -1;
+        }
+        // Returning -1 will signal deletion of dconn.
         return -1;
       }
-      // Returning -1 will signal deletion of dconn.
-      return -1;
-    }
 
-    if (downstream->get_response_state() == Downstream::MSG_COMPLETE) {
-      return -1;
+      if (downstream->get_response_state() == Downstream::MSG_COMPLETE) {
+        return -1;
+      }
     }
 
     auto worker = handler_->get_worker();
diff --git a/src/shrpx_https_upstream.cc b/src/shrpx_https_upstream.cc
index a9d96e71..e0765507 100644
--- a/src/shrpx_https_upstream.cc
+++ b/src/shrpx_https_upstream.cc
@@ -442,15 +442,17 @@ int htp_hdrs_completecb(http_parser *htp) {
 
 #ifdef HAVE_MRUBY
   const auto &group = dconn_ptr->get_downstream_addr_group();
-  const auto &dmruby_ctx = group->mruby_ctx;
+  if (group) {
+    const auto &dmruby_ctx = group->mruby_ctx;
 
-  if (dmruby_ctx->run_on_request_proc(downstream) != 0) {
-    resp.http_status = 500;
-    return -1;
-  }
+    if (dmruby_ctx->run_on_request_proc(downstream) != 0) {
+      resp.http_status = 500;
+      return -1;
+    }
 
-  if (downstream->get_response_state() == Downstream::MSG_COMPLETE) {
-    return 0;
+    if (downstream->get_response_state() == Downstream::MSG_COMPLETE) {
+      return 0;
+    }
   }
 #endif // HAVE_MRUBY
 
@@ -1050,15 +1052,17 @@ int HttpsUpstream::on_downstream_header_complete(Downstream *downstream) {
 #ifdef HAVE_MRUBY
   if (!downstream->get_non_final_response()) {
     const auto &group = dconn->get_downstream_addr_group();
-    const auto &dmruby_ctx = group->mruby_ctx;
+    if (group) {
+      const auto &dmruby_ctx = group->mruby_ctx;
 
-    if (dmruby_ctx->run_on_response_proc(downstream) != 0) {
-      error_reply(500);
-      return -1;
-    }
+      if (dmruby_ctx->run_on_response_proc(downstream) != 0) {
+        error_reply(500);
+        return -1;
+      }
 
-    if (downstream->get_response_state() == Downstream::MSG_COMPLETE) {
-      return -1;
+      if (downstream->get_response_state() == Downstream::MSG_COMPLETE) {
+        return -1;
+      }
     }
 
     auto worker = handler_->get_worker();