walkero
/
nghttp2
1
0
Fork 0
Code Issues Pull Requests Projects Releases 1 Wiki Activity

Fix segfault due to incorrect free, other tweaks

This commit is contained in:
Lucas Pardue 2017-04-25 20:17:47 +01:00
parent f42c1efd59
commit d2c3e1fc45
2 changed files with 5 additions and 20 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

23
lib/nghttp2_session.c
View File

@ -1760,14 +1760,6 @@ static int session_predicate_origin_send(nghttp2_session *session,
return 0;
}
stream = nghttp2_session_get_stream(session, stream_id);
if (stream == NULL) {
return NGHTTP2_ERR_STREAM_CLOSED;
}
if (stream->state == NGHTTP2_STREAM_CLOSING) {
return NGHTTP2_ERR_STREAM_CLOSING;
}
return 0;
}
@ -4826,7 +4818,6 @@ int nghttp2_session_on_altsvc_received(nghttp2_session *session,
return 0;
}
}
return session_call_on_frame_received(session, frame);
}
@ -4854,17 +4845,8 @@ int nghttp2_session_on_origin_received(nghttp2_session *session,
/* session->server case has been excluded */
if (frame->hd.stream_id == 0) {
if (frame->hd.stream_id != 0) {
return 0;
} else {
stream = nghttp2_session_get_stream(session, frame->hd.stream_id);
if (!stream) {
return 0;
}
if (stream->state == NGHTTP2_STREAM_CLOSING) {
return 0;
}
}
return session_call_on_frame_received(session, frame);
@ -6090,6 +6072,9 @@ ssize_t nghttp2_session_mem_recv(nghttp2_session *session, const uint8_t *in,
DEBUGF("recv: origin_len=%zu\n", origin_len);
/*
* TODO: figure out why this check fails
*/
if (2 + origin_len > iframe->payloadleft) {
busy = 1;
iframe->state = NGHTTP2_IB_FRAME_SIZE_ERROR;

2
lib/nghttp2_submit.c
View File

@ -624,7 +624,7 @@ int nghttp2_submit_origin(nghttp2_session *session, uint8_t flags,
rv = nghttp2_session_add_item(session, item);
if (rv != 0) {
nghttp2_frame_altsvc_free(&frame->ext, mem);
nghttp2_frame_origin_free(&frame->ext, mem);
nghttp2_mem_free(mem, item);
return rv;