src: ensure to close stream when destroying session

Co-Authored-By: Anna Henningsen <[email protected]> Reviewed-By: Michael Dawson <[email protected]> Reviewed-By: Marco Ippolito <[email protected]> Reviewed-By: Matteo Collina <[email protected]> Reviewed-By: Benjamin Gruenbaum <[email protected]> PR-URL: nodejs-private/node-private#561 Fixes: https://hackerone.com/reports/2319584 CVE-ID: CVE-2024-27983
nodejs · Apr 2, 2024 · 3bd39fb · 3bd39fb
1 parent 5f0f96b
commit 3bd39fb
Showing 1 changed file with 6 additions and 0 deletions.
diff --git a/src/node_http2.cc b/src/node_http2.cc
@@ -605,6 +605,12 @@ Http2Session::Http2Session(Http2State* http2_state,
 Http2Session::~Http2Session() {
   CHECK(!is_in_scope());
   Debug(this, "freeing nghttp2 session");
+  // Ensure that all `Http2Stream` instances and the memory they hold
+  // on to are destroyed before the nghttp2 session is.
+  for (const auto& [id, stream] : streams_) {
+    stream->Detach();
+  }
+  streams_.clear();
   // Explicitly reset session_ so the subsequent
   // current_nghttp2_memory_ check passes.
   session_.reset();