www/apache
1
0
Fork 0
mirror of https://github.com/apache/httpd.git synced 2026-10-23 22:49:01 +03:00
Code Activity

mod_http2: Don't abort a debug build over a stream reclaimed unprocessed.

Browse Source 
A stream created but never scheduled (e.g. after a connection-level
protocol error) is reclaimed with the session pool rather than
destroyed explicitly, which is harmless; use-after-free is still
caught by H2_STRM_ASSERT_MAGIC at each use. nghttp2 promoted various
stream errors to connection errors in 1.67.0, which triggers this
assertion.

* modules/http2/h2_stream.c (stream_pool_destroy): Trace-log rather than
  assert for a stream reclaimed without an explicit destroy.

* .github/workflows/linux.yml: Add job testing mod_http2 against 1.68.0.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Github: closes #713


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1937524 13f79535-47bb-0310-9956-ffa450edef68
This commit is contained in:
Joe Orton
2026-08-27 17:13:05 +00:00
parent 96db1db7c2
commit afd9f3318b
2 changed files with 20 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
.github/workflows/linux.yml vendored
View File

@@ -145,6 +145,17 @@ jobs:
NO_TEST_FRAMEWORK=1
TEST_PYTEST=1
# -------------------------------------------------------------------------
# Test against a newer nghttp2 than in the Ubuntu images.
- name: mod_http2 w/nghttp2 1.68.0
config: --enable-mods-shared=reallyall --enable-maintainer-mode --with-mpm=event
pkgs: nghttp2-client
env: |
TEST_NGHTTP2=1.68.0
NO_TEST_FRAMEWORK=1
TEST_PYTEST=1
PYHTTPD_TARGETS=modules/http2
PYTEST_ARGS=--only=pyhttpd
# -------------------------------------------------------------------------
- name: Default
# -------------------------------------------------------------------------
- name: All-static modules

12
modules/http2/h2_stream.c
View File

@@ -559,9 +559,15 @@ static apr_status_t stream_pool_destroy(void *data)
h2_stream *stream = data;
switch (stream->magic) {
case H2_STRM_MAGIC_OK:
ap_log_cerror(APLOG_MARK, APLOG_ERR, 0, stream->session->c1,
H2_STRM_MSG(stream, "was not destroyed explicitly"));
AP_DEBUG_ASSERT(0);
/* Reclaimed with the session pool rather than destroyed
* explicitly. This is expected for a stream which was created
* but never scheduled for processing - e.g. one whose request
* nghttp2 rejects before it is handed to the mplx - and is
* harmless, since nothing but the session pool ever owned it.
* Use-after-free of a stream is still caught in any build by the
* H2_STRM_ASSERT_MAGIC at each use. */
ap_log_cerror(APLOG_MARK, APLOG_TRACE1, 0, stream->session->c1,
H2_STRM_MSG(stream, "reclaimed, never processed"));
break;
case H2_STRM_MAGIC_SDEL:
/* stream has been explicitly destroyed, as it should */