From 32a0aa38a49a8d84f80c62e184543dcbd439c5aa Mon Sep 17 00:00:00 2001
From: Dmitri Tikhonov <dtikhonov@litespeedtech.com>
Date: Sat, 6 Mar 2021 22:20:43 -0500
Subject: [PATCH] Release 2.27.7

- [BUGFIX] Infinite loop in stream: returned HQ frame can be at any
  point on the list.
- [BUGFIX] Fail push promise immediately if STREAM_NOPUSH is set.
---
 CHANGELOG                     | 6 ++++++
 docs/conf.py                  | 2 +-
 include/lsquic.h              | 2 +-
 src/liblsquic/lsquic_stream.c | 8 +++++---
 4 files changed, 13 insertions(+), 5 deletions(-)

diff --git a/CHANGELOG b/CHANGELOG
index f0c3877..ef56297 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -1,3 +1,9 @@
+2021-03-06
+    - 2.27.7
+    - [BUGFIX] Infinite loop in stream: returned HQ frame can be at any
+      point on the list.
+    - [BUGFIX] Fail push promise immediately if STREAM_NOPUSH is set.
+
 2021-01-27
     - 2.27.6
     - [BUGFIX] Replace dispatch read/write events assertion with a check.
diff --git a/docs/conf.py b/docs/conf.py
index bb8850a..a9a2a7d 100644
--- a/docs/conf.py
+++ b/docs/conf.py
@@ -26,7 +26,7 @@ author = u'LiteSpeed Technologies'
 # The short X.Y version
 version = u'2.27'
 # The full version, including alpha/beta/rc tags
-release = u'2.27.6'
+release = u'2.27.7'
 
 
 # -- General configuration ---------------------------------------------------
diff --git a/include/lsquic.h b/include/lsquic.h
index f2643b6..aa93dbd 100644
--- a/include/lsquic.h
+++ b/include/lsquic.h
@@ -25,7 +25,7 @@ extern "C" {
 
 #define LSQUIC_MAJOR_VERSION 2
 #define LSQUIC_MINOR_VERSION 27
-#define LSQUIC_PATCH_VERSION 6
+#define LSQUIC_PATCH_VERSION 7
 
 /**
  * Engine flags:
diff --git a/src/liblsquic/lsquic_stream.c b/src/liblsquic/lsquic_stream.c
index 8a9580c..3585abe 100644
--- a/src/liblsquic/lsquic_stream.c
+++ b/src/liblsquic/lsquic_stream.c
@@ -2666,8 +2666,8 @@ static void
 stream_hq_frame_put (struct lsquic_stream *stream,
                                                 struct stream_hq_frame *shf)
 {
-    assert(STAILQ_FIRST(&stream->sm_hq_frames) == shf);
-    STAILQ_REMOVE_HEAD(&stream->sm_hq_frames, shf_next);
+    /* In vast majority of cases, the frame to put is at the head: */
+    STAILQ_REMOVE(&stream->sm_hq_frames, shf, stream_hq_frame, shf_next);
     if (frame_in_stream(stream, shf))
         memset(shf, 0, sizeof(*shf));
     else
@@ -5357,7 +5357,9 @@ lsquic_stream_push_promise (struct lsquic_stream *stream,
     ssize_t nw;
 
     assert(stream->sm_bflags & SMBF_IETF);
-    assert(lsquic_stream_can_push(stream));
+
+    if (stream->stream_flags & STREAM_NOPUSH)
+        return -1;
 
     bits = vint_val2bits(promise->pp_id);
     len = 1 << bits;