Skip to content

Commit d358da4

Browse files
committed
BUG/MINOR: quic: fix crash on quic_conn alloc failure
If there is an alloc failure during qc_new_conn(), cleaning is done via quic_conn_release(). However, since the below commit, an unchecked dereferencing of <qc.path> is performed in the latter. e841164 MINOR: quic: account for global congestion window To fix this, simply check <qc.path> before dereferencing it in quic_conn_release(). This is safe as it is properly initialized to NULL on qc_new_conn() first stage. This does not need to be backported.
1 parent 099c1b2 commit d358da4

File tree

1 file changed

+4
-2
lines changed

1 file changed

+4
-2
lines changed

src/quic_conn.c

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1448,8 +1448,10 @@ int quic_conn_release(struct quic_conn *qc)
14481448
}
14491449

14501450
/* Substract last congestion window from global memory counter. */
1451-
cshared_add(&quic_mem_diff, -qc->path->cwnd);
1452-
qc->path->cwnd = 0;
1451+
if (qc->path) {
1452+
cshared_add(&quic_mem_diff, -qc->path->cwnd);
1453+
qc->path->cwnd = 0;
1454+
}
14531455

14541456
/* free remaining stream descriptors */
14551457
node = eb64_first(&qc->streams_by_id);

0 commit comments

Comments
 (0)