Check return value of h2o_quic_send
After applying h2o/quicly#514, h2o_quic_send may fail and free the connection. If such an error occurs, it should be treated as an fatal error and break the control flow to avoid use-after-free.
@@ -1905,7 +1905,11 @@ h2o_http3_conn_t *h2o_http3_server_accept(h2o_http3_server_ctx_t *ctx, quicly_ad
H2O_PROBE_CONN(H3S_ACCEPT, &conn->super, &conn->super, conn->h3.super.quic, h2o_conn_get_uuid(&conn->super));
- h2o_quic_send(&conn->h3.super);
+ if (h2o_quic_send(&conn->h3.super) == 0) {
+ kh_destroy(stream, conn->datagram_flows);
+ h2o_linklist_unlink(&conn->_conns);
+ return NULL;
+ }
return &conn->h3;
}
