http: couple fetch() receive backpressure to JS body consumption (h1/h2/h3) - #29831
Merged
Jarred-Sumner merged 16 commits intoJun 26, 2026
Claude / Claude Code Review
completed
Jun 26, 2026 in 27m 31s
Code review found 1 potential issue
Found 5 candidates, confirmed 1. See review comments for details.
Details
| Severity | Count |
|---|---|
| 🔴 Important | 0 |
| 🟡 Nit | 1 |
| 🟣 Pre-existing | 0 |
| Severity | File:Line | Issue |
|---|---|---|
| 🟡 Nit | src/http/HTTPThread.rs:826-833 |
h2 session UAF between resume_receive_by_http_id and drain_response_body_by_http_id |
Annotations
Check warning on line 833 in src/http/HTTPThread.rs
claude / Claude Code Review
h2 session UAF between resume_receive_by_http_id and drain_response_body_by_http_id
The h2 arm makes two back-to-back calls on a raw `&mut session` from `tagged.session_mut()` (no refcount bump), and `resume_receive_by_http_id` can reach `fail_all()` → `on_close()` → session freed when its `ref_scope` guard drops — after which `drain_response_body_by_http_id` would dereference freed memory. The trigger (`flush()` returning `Err(WriteFailed)`) is currently unreachable because `us_socket_write` clamps negatives to 0 on both TCP and SSL paths, so this is defense-in-depth rather th
Loading