Crash in h2_progress_egress due to NULL stream

[jbgoog]

I did this

Seeing a crash here during h2_progress_egress call:

    rv = nghttp2_submit_priority(ctx->h2, NGHTTP2_FLAG_NONE,
                                 stream->id, &pri_spec);

stream is NULL so stream->id throws the following error:

EXC_BAD_ACCESS / KERN_INVALID_ADDRESS @0x00000000

I expected the following

• Application does not crash

curl/libcurl version

• 8.1.2

operating system

iOS

[dfandrich]

Can you give us more information? How do you reproduce this problem? What are the versions of the dependencies? The output of curl -V would be a good start.

[jbgoog]

We include libcurl as a dependency of our iOS app, so there is no commandline for curl -V unfortunately.

It looks like this line to get the stream can be NULL:

struct stream_ctx *stream = H2_STREAM_CTX(data);

#define H2_STREAM_CTX(d)    ((struct stream_ctx *)(((d) && (d)->req.p.http)? \
                             ((struct HTTP *)(d)->req.p.http)->h2_ctx \
                               : NULL))

From https://github.com/curl/curl/blob/curl-8_1_2/lib/http2.c#L1659

When that happens, stream->id aborts.

It looks like stream here is only used to get the stream->id

    DEBUGF(LOG_CF(data, cf, "[h2sid=%d] Queuing PRIORITY",
                  stream->id));
    DEBUGASSERT(stream->id != -1);
    rv = nghttp2_submit_priority(ctx->h2, NGHTTP2_FLAG_NONE,
                                 stream->id, &pri_spec);

Otherwise it's unused.

I believe replacing:

 struct stream_ctx *stream = H2_STREAM_CTX(data);

with

int32_t stream_id = H2_STREAM_ID(data);

and then using stream_id directly instead of stream->id will fix the issue.

Testing it now.

[jbgoog]

Here's the stack trace:

(http2.c:1675)		h2_progress_egress
(http2.c:1670)		h2_progress_egress
(http2.c:2199)		cf_h2_connect
(http2.c:2559)		Curl_http2_switch_at
(cf-https-connect.c:182)		baller_connected
(cfilters.c:381)		Curl_conn_connect
(multi.c:2109)		multi_runsingle
(multi.c:2745)		curl_multi_perform

it's unclear if the line numbers are correct but I was able to reproduce the issue with a debugger.

[jbgoog]

This appears to fix the issue: #11380

🥳

[icing]

Thanks. While this avoids the crash, it does not do the needed behaviour. This submits the priority to nghttp2 on stream id -2 and not the stream that, afterwards, will be opened in nghttp2.

The correct way is to delay the priority handling until the stream has been opened. The if should only be entered here when in addition stream != NULL && stream->id > 0. Could you amend your PR in this way?

[icing]

I made #11384 with a test case and fix.

[jbgoog]

Awesome Amazing!