When a connection upgrade is requested and when the
request sent an error reply, the response is most of
the time already sent when the test on
connection->response->upgrade_handler is made, leading
to dereferencing NULL.

Two possibilities exist:

  NULL == connection->response || NULL == connection->response->upgrade_handler

or

  NULL != connection->response && NULL == connection->response->upgrade_handler

The first is prefered because it is probably safer to close the
connection in that case.

Change-Id: Ie6e7fc165f7fe3635ade0952bb34a0b937d38716
Signed-off-by: José Bollo <jo...@nonadev.net>
---
 src/microhttpd/connection.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/microhttpd/connection.c b/src/microhttpd/connection.c
index 4753d6e..91a4492 100644
--- a/src/microhttpd/connection.c
+++ b/src/microhttpd/connection.c
@@ -882,7 +882,7 @@ keepalive_possible (struct MHD_Connection
*connection) #ifdef UPGRADE_SUPPORT
     if ( (MHD_str_equal_caseless_ (end,
                                    "upgrade")) &&
-         (NULL == connection->response->upgrade_handler) )
+         (NULL == connection->response || NULL == 
connection->response->upgrade_handler) )
       return MHD_NO;
 #endif /* UPGRADE_SUPPORT */
 
-- 
2.9.3


Reply via email to