Skip to content

Commit

Permalink
BUG/MINOR: mux-quic: fix crash on qcc_init() early return
Browse files Browse the repository at this point in the history
qcc_release() may be used in case qcc_init() cannot complete. In this
case, connection instance is NULL. As such, it cannot be dereferenced
without testing it first.

This should fix github coverity report #2739.

No backport needed.
  • Loading branch information
a-denoyelle committed Oct 2, 2024
1 parent cea1379 commit 58b7a72
Showing 1 changed file with 9 additions and 6 deletions.
15 changes: 9 additions & 6 deletions src/mux_quic.c
Original file line number Diff line number Diff line change
Expand Up @@ -2626,7 +2626,7 @@ static void qcc_release(struct qcc *qcc)
{
struct connection *conn = qcc->conn;
struct eb64_node *node;
struct quic_conn *qc = conn->handle.qc;
struct quic_conn *qc;

TRACE_ENTER(QMUX_EV_QCC_END, conn);

Expand All @@ -2644,11 +2644,14 @@ static void qcc_release(struct qcc *qcc)
}

/* unsubscribe from all remaining qc_stream_desc */
node = eb64_first(&qc->streams_by_id);
while (node) {
struct qc_stream_desc *stream = eb64_entry(node, struct qc_stream_desc, by_id);
qc_stream_desc_sub_room(stream, NULL);
node = eb64_next(node);
if (conn) {
qc = conn->handle.qc;
node = eb64_first(&qc->streams_by_id);
while (node) {
struct qc_stream_desc *stream = eb64_entry(node, struct qc_stream_desc, by_id);
qc_stream_desc_sub_room(stream, NULL);
node = eb64_next(node);
}
}

tasklet_free(qcc->wait_event.tasklet);
Expand Down

0 comments on commit 58b7a72

Please sign in to comment.