don't call client_close() from fcgi/proxy bev handlers

We might end up calling client_close() from start_reply(), but that
will free the fcgi/proxy bufferevent while they're still used on the
stack.

Instead, start_reply() only sets REQUEST_DONE and exits, returning the
error eventually, so callers know when to stop.

1 files changed, 5 insertions, 4 deletions

diff --git a/server.c b/server.c
index 4678e3f..4e163b0 100644
--- a/server.c
+++ b/server.c
@@ -1122,7 +1122,7 @@ client_error(struct bufferevent *bev, short error, void *d)
 	client_close(c);
 }
 
-void
+int
 start_reply(struct client *c, int code, const char *meta)
 {
 	struct evbuffer	*evb = EVBUFFER_OUTPUT(c->bev);
@@ -1161,18 +1161,19 @@ start_reply(struct client *c, int code, const char *meta)
 	if (code != 20)
 		c->type = REQUEST_DONE;
 
-	return;
+	return 0;
 
 err:
 	log_warnx("evbuffer_add_printf error: no memory");
 	evbuffer_drain(evb, EVBUFFER_LENGTH(evb));
-	client_close(c);
-	return;
+	c->type = REQUEST_DONE;
+	return -1;
 
 overflow:
 	log_warnx("reply header overflow");
 	evbuffer_drain(evb, EVBUFFER_LENGTH(evb));
 	start_reply(c, TEMP_FAILURE, "internal error");
+	return -1;
 }
 
 static void