From 6b949b3920b0ca0aa2a4e736927a562c13a04376 Mon Sep 17 00:00:00 2001
From: Valentin Bartenev <vbart@nginx.com>
Date: Wed, 22 Jan 2014 04:58:19 +0400
Subject: SPDY: fixed possible segfault.

While processing a DATA frame, the link to related stream is stored in spdy
connection object as part of connection state.  But this stream can be closed
between receiving parts of the frame.
---
 src/http/ngx_http_spdy.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/src/http/ngx_http_spdy.c b/src/http/ngx_http_spdy.c
index 7c93dc49a..f4f610a82 100644
--- a/src/http/ngx_http_spdy.c
+++ b/src/http/ngx_http_spdy.c
@@ -2626,6 +2626,10 @@ ngx_http_spdy_close_stream(ngx_http_spdy_stream_t *stream, ngx_int_t rc)
         }
     }
 
+    if (sc->stream == stream) {
+        sc->stream = NULL;
+    }
+
     sscf = ngx_http_get_module_srv_conf(sc->http_connection->conf_ctx,
                                         ngx_http_spdy_module);
 
-- 
cgit