Commit b4c39010 authored by Daniel Stenberg's avatar Daniel Stenberg
Browse files

http2: http_done: don't free already-freed push headers 

The push headers are freed after the push callback has been invoked,
meaning this code should only free the headers if the callback was never
invoked and thus the headers weren't freed at that time.

Reported-by: Davey Shafik
parent a72207ec

lib/http.c

+7 −4
Original line number Diff line number Diff line
@@ -1480,12 +1480,15 @@ CURLcode Curl_http_done(struct connectdata *conn, 
    DEBUGF(infof(data, "free header_recvbuf!!\n"));

    Curl_add_buffer_free(http->header_recvbuf);

    http->header_recvbuf = NULL; /* clear the pointer */

    if(http->push_headers) {

      /* if they weren't used and then freed before */

      for(; http->push_headers_used > 0; --http->push_headers_used) {

        free(http->push_headers[http->push_headers_used - 1]);

      }

      free(http->push_headers);

      http->push_headers = NULL;

    }

  }

  if(http->stream_id) {

    nghttp2_session_set_stream_user_data(httpc->h2, http->stream_id, 0);

    http->stream_id = 0;