[GNUnet-SVN] [gnurl] 91/178: http2: handle on_begin_headers() called more than once

[gnunet]

This is an automated email from the git hooks/post-receive script.

ng0 pushed a commit to branch master
in repository gnurl.

commit 6d3c9c8ab4754ea21622d65f11df403bbaf46e2d
Author: Daniel Stenberg <address@hidden>
AuthorDate: Wed Apr 18 23:51:01 2018 +0200

    http2: handle on_begin_headers() called more than once
    
    This triggered an assert if called more than once in debug mode (and a
    memory leak if not debug build). With the right sequence of HTTP/2
    headers incoming it can happen.
    
    Detected by OSS-Fuzz
    
    Closes #2507
    Bug: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=7764
---
 lib/http2.c | 12 ++++--------
 1 file changed, 4 insertions(+), 8 deletions(-)

diff --git a/lib/http2.c b/lib/http2.c
index 6758f9554..e60ae247b 100644
--- a/lib/http2.c
+++ b/lib/http2.c
@@ -870,16 +870,12 @@ static int on_begin_headers(nghttp2_session *session,
     return 0;
   }
 
-  /* This is trailer HEADERS started.  Allocate buffer for them. */
-  H2BUGF(infof(data_s, "trailer field started\n"));
-
-  DEBUGASSERT(stream->trailer_recvbuf == NULL);
-
-  stream->trailer_recvbuf = Curl_add_buffer_init();
   if(!stream->trailer_recvbuf) {
-    return NGHTTP2_ERR_TEMPORAL_CALLBACK_FAILURE;
+    stream->trailer_recvbuf = Curl_add_buffer_init();
+    if(!stream->trailer_recvbuf) {
+      return NGHTTP2_ERR_TEMPORAL_CALLBACK_FAILURE;
+    }
   }
-
   return 0;
 }
 

-- 
To stop receiving notification emails like this one, please contact
address@hidden