From 32bb39c48fd8f9d1481353adb5e428a6097f7ee9 Mon Sep 17 00:00:00 2001
From: Valentin Bartenev <vbart@nginx.com>
Date: Wed, 22 Jan 2014 04:58:19 +0400
Subject: [PATCH] SPDY: fixed possible segfault.

While processing a DATA frame, the link to related stream is stored in spdy
connection object as part of connection state.  But this stream can be closed
between receiving parts of the frame.
---
 src/http/ngx_http_spdy.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/src/http/ngx_http_spdy.c b/src/http/ngx_http_spdy.c
index a01e0b100..bfed97bdc 100644
--- a/src/http/ngx_http_spdy.c
+++ b/src/http/ngx_http_spdy.c
@@ -2665,6 +2665,10 @@ ngx_http_spdy_close_stream(ngx_http_spdy_stream_t *stream, ngx_int_t rc)
         }
     }
 
+    if (sc->stream == stream) {
+        sc->stream = NULL;
+    }
+
     if (stream->handled) {
         for (s = sc->last_stream; s; s = s->next) {
             if (s->next == stream) {