From f3159f81c2144305ca9288886b09bbcb31b6a7bc Mon Sep 17 00:00:00 2001 From: Joe Orton Date: Thu, 27 Aug 2026 10:56:31 +0100 Subject: [PATCH 1/2] mod_http2: Don't abort a debug build over a stream reclaimed unprocessed. A stream created but never scheduled (e.g. after a connection-level protocol error) is reclaimed with the session pool rather than destroyed explicitly, which is harmless; use-after-free is still caught by H2_STRM_ASSERT_MAGIC at each use. * modules/http2/h2_stream.c (stream_pool_destroy): Trace-log rather than assert for a stream reclaimed without an explicit destroy. Co-Authored-By: Claude Opus 5 (1M context) --- modules/http2/h2_stream.c | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) diff --git a/modules/http2/h2_stream.c b/modules/http2/h2_stream.c index 44969cf0881..a1c6b6cc069 100644 --- a/modules/http2/h2_stream.c +++ b/modules/http2/h2_stream.c @@ -559,9 +559,15 @@ static apr_status_t stream_pool_destroy(void *data) h2_stream *stream = data; switch (stream->magic) { case H2_STRM_MAGIC_OK: - ap_log_cerror(APLOG_MARK, APLOG_ERR, 0, stream->session->c1, - H2_STRM_MSG(stream, "was not destroyed explicitly")); - AP_DEBUG_ASSERT(0); + /* Reclaimed with the session pool rather than destroyed + * explicitly. This is expected for a stream which was created + * but never scheduled for processing - e.g. one whose request + * nghttp2 rejects before it is handed to the mplx - and is + * harmless, since nothing but the session pool ever owned it. + * Use-after-free of a stream is still caught in any build by the + * H2_STRM_ASSERT_MAGIC at each use. */ + ap_log_cerror(APLOG_MARK, APLOG_TRACE1, 0, stream->session->c1, + H2_STRM_MSG(stream, "reclaimed, never processed")); break; case H2_STRM_MAGIC_SDEL: /* stream has been explicitly destroyed, as it should */ From 1e8a9a8658203960a7fa7f75c7be8bbbe9639ebb Mon Sep 17 00:00:00 2001 From: Joe Orton Date: Wed, 26 Aug 2026 08:12:45 +0100 Subject: [PATCH 2/2] CI: Add a job running the mod_http2 tests against nghttp2 1.68.0. nghttp2 promoted various stream errors to connection errors in 1.67.0, which mod_http2 handles differently; the runner image is still on 1.59. * .github/workflows/linux.yml: Add the job. Co-Authored-By: Claude Opus 5 (1M context) --- .github/workflows/linux.yml | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/.github/workflows/linux.yml b/.github/workflows/linux.yml index 9386bef8c6e..9603f2e56db 100644 --- a/.github/workflows/linux.yml +++ b/.github/workflows/linux.yml @@ -145,6 +145,19 @@ jobs: NO_TEST_FRAMEWORK=1 TEST_PYTEST=1 # ------------------------------------------------------------------------- + # nghttp2 promoted various stream errors to connection errors in + # 1.67.0, which mod_http2 handles differently; the runner image + # is still on 1.59, so build a newer release from source. + - name: mod_http2 w/nghttp2 1.68.0 + config: --enable-mods-shared=reallyall --enable-maintainer-mode --with-mpm=event + pkgs: nghttp2-client + env: | + TEST_NGHTTP2=1.68.0 + NO_TEST_FRAMEWORK=1 + TEST_PYTEST=1 + PYHTTPD_TARGETS=modules/http2 + PYTEST_ARGS=--only=pyhttpd + # ------------------------------------------------------------------------- - name: Default # ------------------------------------------------------------------------- - name: All-static modules