commit bb1eab9cb33e22e545fa6798b0e79f2e6b7973ae
author Valentin Bartenev <vbart@nginx.com> Thu Jun 16 20:55:11 2016 +0300
committer Valentin Bartenev <vbart@nginx.com> Thu Jun 16 20:55:11 2016 +0300
tree f1c3aaa5692befe5fdc8dd08151196d3afdeb193
parent 05e6a7c62cea1df6f67319333bcc07009d7581b8

HTTP/2: fixed a segfault while processing unbuffered upload.

The ngx_http_v2_finalize_connection() closes current stream, but that is an
invalid operation while processing unbuffered upload.  This results in access
to already freed memory, since the upstream module sets a cleanup handler that
also finalizes the request.

src/http/v2/ngx_http_v2.c

diff --git a/src/http/v2/ngx_http_v2.c b/src/http/v2/ngx_http_v2.c
index 208f0f3..94f57a7 100644
--- a/src/http/v2/ngx_http_v2.c
+++ b/src/http/v2/ngx_http_v2.c
@@ -4169,10 +4169,6 @@
 
     c->error = 1;
 
-    if (h2c->state.stream) {
-        ngx_http_v2_close_stream(h2c->state.stream, NGX_HTTP_BAD_REQUEST);
-    }
-
     if (!h2c->processing) {
         ngx_http_close_connection(c);
         return;