From: Seonah Moon <seonah1.moon@samsung.com>
Date: Wed, 18 Oct 2023 13:04:22 +0000 (+0900)
Subject: H2: fix crash issue
X-Git-Tag: accepted/tizen/6.5/base/20231026.094327^0
X-Git-Url: http://review.tizen.org/git/?a=commitdiff_plain;h=refs%2Fheads%2Ftizen_6.5_base;p=platform%2Fupstream%2Fcurl.git

H2: fix crash issue

Backport partially to solve the crash
https://github.com/curl/curl/pull/11563/commits/d58827b0ed9d5b66c99fbe29d9b82c7fccd36e76

Change-Id: If4b3a69b08075bb25468f9194637b53be1bf606a
---

diff --git a/lib/http2.c b/lib/http2.c
index 925d9828b..06cc1bda4 100644
--- a/lib/http2.c
+++ b/lib/http2.c
@@ -1585,6 +1585,17 @@ static ssize_t http2_recv(struct connectdata *conn, int sockindex,
     return -1;
   }
 
+  if(!stream) {
+    /* Abnormal call sequence: either this transfer has never opened a stream
+     * (unlikely) or the transfer has been done, cleaned up its resources, but
+     * a read() is called anyway. It is not clear what the calling sequence
+     * is for such a case. */
+    failf(data, "http2_recv: http/2 recv on a transfer never opened "
+          "or already cleared\n");
+    *err = CURLE_HTTP2;
+    return -1;
+  }
+
   /* Nullify here because we call nghttp2_session_send() and they
      might refer to the old buffer. */
   stream->upload_mem = NULL;