From e1b8f1a8c3fdfc6a952c2c8d9797a68556a582a4 Mon Sep 17 00:00:00 2001
From: Dmitri Tikhonov <dtikhonov@litespeedtech.com>
Date: Mon, 8 Mar 2021 10:44:37 -0500
Subject: [PATCH] Release 2.29.4

- [BUGFIX] Infinite loop in stream: returned HQ frame can be at any
  point on the list.
- [BUGFIX] Fail push promise immediately if STREAM_NOPUSH is set.
---
 CHANGELOG                     | 6 ++++++
 docs/conf.py                  | 2 +-
 include/lsquic.h              | 2 +-
 src/liblsquic/lsquic_stream.c | 8 +++++---
 4 files changed, 13 insertions(+), 5 deletions(-)

diff --git a/CHANGELOG b/CHANGELOG
index 4da8453..90693cd 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -1,3 +1,9 @@
+2021-03-08
+    - 2.29.4
+    - [BUGFIX] Infinite loop in stream: returned HQ frame can be at any
+      point on the list.
+    - [BUGFIX] Fail push promise immediately if STREAM_NOPUSH is set.
+
 2021-03-03
     - 2.29.3
     - [BUGFIX] Do not send RESET_STREAM if writing to stream is already
diff --git a/docs/conf.py b/docs/conf.py
index 50b5301..6c942f3 100644
--- a/docs/conf.py
+++ b/docs/conf.py
@@ -26,7 +26,7 @@ author = u'LiteSpeed Technologies'
 # The short X.Y version
 version = u'2.29'
 # The full version, including alpha/beta/rc tags
-release = u'2.29.3'
+release = u'2.29.4'
 
 
 # -- General configuration ---------------------------------------------------
diff --git a/include/lsquic.h b/include/lsquic.h
index 8f02a28..164ff7c 100644
--- a/include/lsquic.h
+++ b/include/lsquic.h
@@ -25,7 +25,7 @@ extern "C" {
 
 #define LSQUIC_MAJOR_VERSION 2
 #define LSQUIC_MINOR_VERSION 29
-#define LSQUIC_PATCH_VERSION 3
+#define LSQUIC_PATCH_VERSION 4
 
 /**
  * Engine flags:
diff --git a/src/liblsquic/lsquic_stream.c b/src/liblsquic/lsquic_stream.c
index 88df6d2..931f87f 100644
--- a/src/liblsquic/lsquic_stream.c
+++ b/src/liblsquic/lsquic_stream.c
@@ -2669,8 +2669,8 @@ static void
 stream_hq_frame_put (struct lsquic_stream *stream,
                                                 struct stream_hq_frame *shf)
 {
-    assert(STAILQ_FIRST(&stream->sm_hq_frames) == shf);
-    STAILQ_REMOVE_HEAD(&stream->sm_hq_frames, shf_next);
+    /* In vast majority of cases, the frame to put is at the head: */
+    STAILQ_REMOVE(&stream->sm_hq_frames, shf, stream_hq_frame, shf_next);
     if (frame_in_stream(stream, shf))
         memset(shf, 0, sizeof(*shf));
     else
@@ -5383,7 +5383,9 @@ lsquic_stream_push_promise (struct lsquic_stream *stream,
     ssize_t nw;
 
     assert(stream->sm_bflags & SMBF_IETF);
-    assert(lsquic_stream_can_push(stream));
+
+    if (stream->stream_flags & STREAM_NOPUSH)
+        return -1;
 
     bits = vint_val2bits(promise->pp_id);
     len = 1 << bits;