Commit 83373e2
http2: avoid race condition in OnHeaderCallback
Fixes: #21416
PR-URL: #22256
Reviewed-By: Anna Henningsen <anna@addaleax.net>
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com>
Reviewed-By: George Adams <george.adams@uk.ibm.com>1 parent 4dfafac commit 83373e2
1 file changed
Lines changed: 6 additions & 1 deletion
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
@@ -881,7 +881,12 @@ int Http2Session::OnHeaderCallback(nghttp2_session* handle, | |||
| 881 | 881 | Http2Session* session = static_cast<Http2Session*>(user_data); | |
| 882 | 882 | int32_t id = GetFrameID(frame); | |
| 883 | 883 | Http2Stream* stream = session->FindStream(id); | |
| 884 | - CHECK_NOT_NULL(stream); | ||
| 884 | + // If stream is null at this point, either something odd has happened | ||
| 885 | + // or the stream was closed locally while header processing was occurring. | ||
| 886 | + // either way, do not proceed and close the stream. | ||
| 887 | + if (stream == nullptr) | ||
| 888 | + return NGHTTP2_ERR_TEMPORAL_CALLBACK_FAILURE; | ||
| 889 | + | ||
| 885 | 890 | // If the stream has already been destroyed, ignore. | |
| 886 | 891 | if (!stream->IsDestroyed() && !stream->AddHeader(name, value, flags)) { | |
| 887 | 892 | // This will only happen if the connected peer sends us more | |
0 commit comments