Fixed segmentation fault during reconfiguration.

If idle connection was closed before h1proto had been allocated
then c->socket.data is NULL.  This happens if nxt_h1p_idle_response()
is called by nxt_h1p_idle_close().  However, h1p->conn_write_tail
is used only in nxt_h1p_request_send() that would not be called
after nxt_h1p_idle_response().

The bug was introduced in f237e8c553fd.
This commit is contained in:
Igor Sysoev
2020-09-18 13:20:06 +03:00
parent 6cfbf4ba79
commit 6b9882fc14

View File

@@ -1876,7 +1876,6 @@ nxt_h1p_idle_response(nxt_task_t *task, nxt_conn_t *c)
u_char *p;
size_t size;
nxt_buf_t *out, *last;
nxt_h1proto_t *h1p;
size = nxt_length(NXT_H1P_IDLE_TIMEOUT)
+ nxt_http_date_cache.size
@@ -1906,9 +1905,6 @@ nxt_h1p_idle_response(nxt_task_t *task, nxt_conn_t *c)
last->completion_handler = nxt_h1p_idle_response_sent;
last->parent = c;
h1p = c->socket.data;
h1p->conn_write_tail = &last->next;
c->write = out;
c->write_state = &nxt_h1p_timeout_response_state;