diff options
| author | Valentin Bartenev <vbart@nginx.com> | 2014-01-22 04:58:19 +0400 |
|---|---|---|
| committer | Valentin Bartenev <vbart@nginx.com> | 2014-01-22 04:58:19 +0400 |
| commit | 32bb39c48fd8f9d1481353adb5e428a6097f7ee9 (patch) | |
| tree | e624293e3cbdf3f7ff798a39b077644eb0ca6463 | |
| parent | a0015da906a30ed111512091e2e8ff9b0d6c199b (diff) | |
| download | nginx-32bb39c48fd8f9d1481353adb5e428a6097f7ee9.tar.gz nginx-32bb39c48fd8f9d1481353adb5e428a6097f7ee9.tar.bz2 | |
SPDY: fixed possible segfault.
While processing a DATA frame, the link to related stream is stored in spdy
connection object as part of connection state. But this stream can be closed
between receiving parts of the frame.
| -rw-r--r-- | src/http/ngx_http_spdy.c | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/src/http/ngx_http_spdy.c b/src/http/ngx_http_spdy.c index a01e0b100..bfed97bdc 100644 --- a/src/http/ngx_http_spdy.c +++ b/src/http/ngx_http_spdy.c @@ -2665,6 +2665,10 @@ ngx_http_spdy_close_stream(ngx_http_spdy_stream_t *stream, ngx_int_t rc) } } + if (sc->stream == stream) { + sc->stream = NULL; + } + if (stream->handled) { for (s = sc->last_stream; s; s = s->next) { if (s->next == stream) { |