tempesta-tech / tempesta

All-in-one solution for high performance web content delivery and advanced protection against DDoS and web attacks
https://tempesta-tech.com/
GNU General Public License v2.0
623 stars 103 forks source link

Fix double free of `stream->msg` #2288

Closed EvgeniiMekhanik closed 2 days ago

EvgeniiMekhanik commented 2 days ago

We should zero stream->msg pointer in tfw_h2_stream_unlink_nolock function regardless of whether we delete the message directly in this function or not. If request is fully parsed it will be deleted later in tfw_http_resp_cache_cb->tfw_h2_resp_adjust_fwd and if we don't zero stream->msg in tfw_h2_stream_unlink_nolock we access already freed request in test_bit(TFW_HTTP_B_FULLY_PARSED, hmreq->flags).

Closes #2285