From 00aaa3aa12d2fda0d1ea9ffdb751eb186a69cee8 Mon Sep 17 00:00:00 2001
From: Andy Green <andy.green@linaro.org>
Date: Thu, 25 Feb 2016 21:55:06 +0800
Subject: [PATCH] close wsi must do detatch ah flow even if no ah

Signed-off-by: Andy Green <andy.green@linaro.org>
---
 changelog           |  8 ++++++++
 lib/libwebsockets.c |  7 ++++---
 lib/parsers.c       | 23 +++++++++++------------
 3 files changed, 23 insertions(+), 15 deletions(-)

diff --git a/changelog b/changelog
index 48421ba..2e99106 100644
--- a/changelog
+++ b/changelog
@@ -1,6 +1,13 @@
 Changelog
 ---------
 
+Fixes
+-----
+
+1) MAJOR connections on ah waiting list that closed did not get removed from
+the waiting list...
+
+
 v1.7.2
 ======
 
@@ -41,6 +48,7 @@ Fixes
 get sent a content-length resulting in the link hanging until the peer closed
 it.  attack.sh updated to add a test for this.
 
+
 Changes
 -------
 
diff --git a/lib/libwebsockets.c b/lib/libwebsockets.c
index a564520..68edfd9 100644
--- a/lib/libwebsockets.c
+++ b/lib/libwebsockets.c
@@ -53,11 +53,12 @@ lws_free_wsi(struct lws *wsi)
 	lws_free_set_NULL(wsi->rxflow_buffer);
 	lws_free_set_NULL(wsi->trunc_alloc);
 
-	if (wsi->u.hdr.ah) {
+	if (wsi->u.hdr.ah)
 		/* we're closing, losing some rx is OK */
 		wsi->u.hdr.ah->rxpos = wsi->u.hdr.ah->rxlen;
-		lws_header_table_detach(wsi);
-	}
+
+	/* we may not have an ah, but may be on the waiting list... */
+	lws_header_table_detach(wsi);
 
 	wsi->context->count_wsi_allocated--;
 	lwsl_debug("%s: %p, remaining wsi %d\n", __func__, wsi,
diff --git a/lib/parsers.c b/lib/parsers.c
index af4c129..0dee8ca 100644
--- a/lib/parsers.c
+++ b/lib/parsers.c
@@ -190,19 +190,18 @@ int lws_header_table_detach(struct lws *wsi)
 
 	pwsi = &pt->ah_wait_list;
 	if (!ah) { /* remove from wait list if none attached */
-//		if (wsi->socket_is_permanently_unusable)
-			while (*pwsi) {
-				if (*pwsi == wsi) {
-					lwsl_info("%s: wsi %p, remv wait\n",
-						  __func__, wsi);
-					*pwsi = wsi->u.hdr.ah_wait_list;
-					wsi->u.hdr.ah_wait_list = NULL;
-					pt->ah_wait_list_length--;
-					goto bail;
-				}
-				pwsi = &(*pwsi)->u.hdr.ah_wait_list;
+		while (*pwsi) {
+			if (*pwsi == wsi) {
+				lwsl_info("%s: wsi %p, remv wait\n",
+					  __func__, wsi);
+				*pwsi = wsi->u.hdr.ah_wait_list;
+				wsi->u.hdr.ah_wait_list = NULL;
+				pt->ah_wait_list_length--;
+				goto bail;
 			}
-
+			pwsi = &(*pwsi)->u.hdr.ah_wait_list;
+		}
+		/* no ah, not on list... no more business here */
 		goto bail;
 	}
 	/* we did have an ah attached */
-- 
2.7.4