Release 2.27.7

- [BUGFIX] Infinite loop in stream: returned HQ frame can be at any
  point on the list.
- [BUGFIX] Fail push promise immediately if STREAM_NOPUSH is set.

CHANGELOG

@@ -1,3 +1,9 @@
+2021-03-06
+    - 2.27.7
+    - [BUGFIX] Infinite loop in stream: returned HQ frame can be at any
+      point on the list.
+    - [BUGFIX] Fail push promise immediately if STREAM_NOPUSH is set.
+
 2021-01-27
     - 2.27.6
     - [BUGFIX] Replace dispatch read/write events assertion with a check.

docs/conf.py

@@ -26,7 +26,7 @@ author = u'LiteSpeed Technologies'
 # The short X.Y version
 version = u'2.27'
 # The full version, including alpha/beta/rc tags
-release = u'2.27.6'
+release = u'2.27.7'
 
 
 # -- General configuration ---------------------------------------------------

include/lsquic.h

@@ -25,7 +25,7 @@ extern "C" {
 
 #define LSQUIC_MAJOR_VERSION 2
 #define LSQUIC_MINOR_VERSION 27
-#define LSQUIC_PATCH_VERSION 6
+#define LSQUIC_PATCH_VERSION 7
 
 /**
  * Engine flags:

src/liblsquic/lsquic_stream.c

@@ -2666,8 +2666,8 @@ static void
 stream_hq_frame_put (struct lsquic_stream *stream,
                                                 struct stream_hq_frame *shf)
 {
-    assert(STAILQ_FIRST(&stream->sm_hq_frames) == shf);
-    STAILQ_REMOVE_HEAD(&stream->sm_hq_frames, shf_next);
+    /* In vast majority of cases, the frame to put is at the head: */
+    STAILQ_REMOVE(&stream->sm_hq_frames, shf, stream_hq_frame, shf_next);
     if (frame_in_stream(stream, shf))
         memset(shf, 0, sizeof(*shf));
     else
@@ -5357,7 +5357,9 @@ lsquic_stream_push_promise (struct lsquic_stream *stream,
     ssize_t nw;
 
     assert(stream->sm_bflags & SMBF_IETF);
-    assert(lsquic_stream_can_push(stream));
+
+    if (stream->stream_flags & STREAM_NOPUSH)
+        return -1;
 
     bits = vint_val2bits(promise->pp_id);
     len = 1 << bits;