Fix: if push promise fails, do not invoke hset destructor

This commit is contained in:
Dmitri Tikhonov 2020-11-17 11:04:32 -05:00
parent df40e9cdd0
commit 0098937630
3 changed files with 20 additions and 4 deletions

View file

@ -4084,10 +4084,15 @@ full_conn_ci_push_stream (struct lsquic_conn *lconn, void *hset,
if (0 != lsquic_headers_stream_push_promise(conn->fc_pub.u.gquic.hs, dep_stream->id,
pushed_stream->id, path, host, headers))
{
/* Since the failure to write to HEADERS stream results in aborting
* the connection, we do not bother rolling back.
*/
LSQ_ERROR("could not send push promise");
/* If forget we ever had the hset pointer: */
lsquic_stream_drop_hset_ref(pushed_stream);
/* Now roll back stream creation and return stream ID: */
if (pushed_stream->sm_hash_el.qhe_flags & QHE_HASHED)
lsquic_hash_erase(conn->fc_pub.all_streams,
&pushed_stream->sm_hash_el);
lsquic_stream_destroy(pushed_stream);
conn->fc_last_stream_id -= 2;
LSQ_INFO("could not send push promise");
return -1;
}

View file

@ -536,6 +536,14 @@ drop_buffered_data (struct lsquic_stream *stream)
}
void
lsquic_stream_drop_hset_ref (struct lsquic_stream *stream)
{
if (stream->uh)
stream->uh->uh_hset = NULL;
}
static void
destroy_uh (struct lsquic_stream *stream)
{

View file

@ -606,4 +606,7 @@ lsquic_stream_verify_len (struct lsquic_stream *, unsigned long long);
#define lsquic_stream_is_blocked(stream_) ((stream_)->blocked_off && \
(stream_)->blocked_off == (stream_)->max_send_off)
void
lsquic_stream_drop_hset_ref (struct lsquic_stream *);
#endif