romenskiy2012/curl
1
0
Fork 0
mirror of https://github.com/curl/curl.git synced 2026-08-25 06:23:30 +03:00
Code Issues Projects Releases Packages Wiki Activity

HTTP/2, HTTP/3: handle detach of onoing transfers

Browse source 
- refs #12356 where a UAF is reported when closing a connection
  with a stream whose easy handle was cleaned up already
- handle DETACH events same as DONE events in h2/h3 filters

Fixes #12356
Reported-by: Paweł Wegner
Closes #12364
This commit is contained in:
Stefan Eissing 2023-11-20 11:32:19 +01:00 • committed by Daniel Stenberg
parent 413a0fedd0
commit b06b6216a3
No known key found for this signature in database
GPG key ID: 5CC908FDB71E12C2
3 changed files with 35 additions and 9 deletions
Download patch file Download diff file Expand all files Collapse all files

9
lib/http2.c
View file

@ -2486,14 +2486,15 @@ static CURLcode cf_h2_cntrl(struct Curl_cfilter *cf,
case CF_CTRL_DATA_PAUSE:
result = http2_data_pause(cf, data, (arg1 != 0));
break;
case CF_CTRL_DATA_DONE_SEND: {
case CF_CTRL_DATA_DONE_SEND:
result = http2_data_done_send(cf, data);
break;
}
case CF_CTRL_DATA_DONE: {
case CF_CTRL_DATA_DETACH:
http2_data_done(cf, data, TRUE);
break;
case CF_CTRL_DATA_DONE:
http2_data_done(cf, data, arg1 != 0);
break;
}
default:
break;
}