Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

http2: fix double free due to handling of rst_stream with cancel code #39423

Closed
wants to merge 2 commits into from
Closed

http2: fix double free due to handling of rst_stream with cancel code #39423

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
f3ea45e
http2: on receiving rst_stream with cancel code add it to pending list
kumarak Jul 17, 2021
59497fb
http2: update checks for adding rst_stream to pending list
kumarak Jul 18, 2021
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
19 changes: 19 additions & 0 deletions src/node_http2.cc
View file
Open in desktop
Expand Up @@ -2195,6 +2195,25 @@ int Http2Stream::SubmitPriority(const Http2Priority& priority,
void Http2Stream::SubmitRstStream(const uint32_t code) {
CHECK(!this->is_destroyed());
code_ = code;

// If RST_STREAM frame is received and stream is not writable
// because it is busy reading data, don't try force purging it.
// Instead add the stream to pending stream list and process
// the pending data when it is safe to do so. This is to avoid
// double free error due to unwanted behavior of nghttp2.
// Ref:https://github.com/nodejs/node/issues/38964

// Add stream to the pending list if it is received with scope
// below in the stack. The pending list may not get processed
// if RST_STREAM received is not in scope and added to the list
// causing endpoint to hang.
if (session_->is_in_scope() &&
!is_writable() && is_reading()) {
session_->AddPendingRstStream(id_);
return;
}


// If possible, force a purge of any currently pending data here to make sure
// it is sent before closing the stream. If it returns non-zero then we need
// to wait until the current write finishes and try again to avoid nghttp2
Expand Down