From 4413e567166e6264e4dd643d6f0232ca4090b47d Mon Sep 17 00:00:00 2001 From: Joe Schaefer Date: Tue, 7 Apr 2026 09:00:57 -0400 Subject: [PATCH 1/2] Fix incorrect pool reference in h2_request_rcreate --- modules/http2/h2_stream.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/http2/h2_stream.c b/modules/http2/h2_stream.c index f0e671ca5d6..3cec981a054 100644 --- a/modules/http2/h2_stream.c +++ b/modules/http2/h2_stream.c @@ -659,7 +659,7 @@ apr_status_t h2_stream_set_request_rec(h2_stream *stream, if (stream->rst_error) { return APR_ECONNRESET; } - status = h2_request_rcreate(&req, stream->pool, r, + status = h2_request_rcreate(&req, r->pool, r, &stream->session->hd_scratch); if (status == APR_SUCCESS) { ap_log_rerror(APLOG_MARK, APLOG_DEBUG, status, r, From 7d87d0726463842f9698f6b02e128562b04213b8 Mon Sep 17 00:00:00 2001 From: Joe Schaefer Date: Wed, 8 Apr 2026 20:23:31 -0400 Subject: [PATCH 2/2] Check if streams exist before getting stream segfaults on certain subrequests --- modules/http2/h2_mplx.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/modules/http2/h2_mplx.c b/modules/http2/h2_mplx.c index 8053f60c9a2..16e528de957 100644 --- a/modules/http2/h2_mplx.c +++ b/modules/http2/h2_mplx.c @@ -603,7 +603,8 @@ const h2_stream *h2_mplx_c2_stream_get(h2_mplx *m, int stream_id) h2_stream *s = NULL; H2_MPLX_ENTER_ALWAYS(m); - s = h2_ihash_get(m->streams, stream_id); + if (m->streams) + s = h2_ihash_get(m->streams, stream_id); H2_MPLX_LEAVE(m); return s;