diff options
| author | Daniel Stenberg <daniel@haxx.se> | 2018-08-22 09:47:22 +0200 |
|---|---|---|
| committer | Daniel Stenberg <daniel@haxx.se> | 2018-08-22 09:47:22 +0200 |
| commit | 78d5302b5c05a49ecfa2ee8b8f1a21a2902357d3 (patch) | |
| tree | 6f73982b37d76f55374697c26c6867038e6f9d7d | |
| parent | 396fc0843eeb435423b76ab9fbaeb27f0a21b0a9 (diff) | |
| download | curl-78d5302b5c05a49ecfa2ee8b8f1a21a2902357d3.tar.gz | |
http2: abort the send_callback if not setup yet
When Curl_http2_done() gets called before the http2 data is setup all
the way, we cannot send anything and this should just return an error.
Detected by OSS-Fuzz
Bug: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=10012
| -rw-r--r-- | lib/http2.c | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/lib/http2.c b/lib/http2.c index 251fcd8e8..22655e94c 100644 --- a/lib/http2.c +++ b/lib/http2.c @@ -370,6 +370,10 @@ static ssize_t send_callback(nghttp2_session *h2, (void)h2; (void)flags; + if(!c->send_underlying) + /* called before setup properly! */ + return NGHTTP2_ERR_CALLBACK_FAILURE; + written = ((Curl_send*)c->send_underlying)(conn, FIRSTSOCKET, data, length, &result); |