WIP: crash (references to frames on stack)

src/quic_tx.c

@@ -147,7 +147,7 @@ static void qc_dup_pkt_frms(struct quic_conn *qc,
 		TRACE_DEVEL("built probing frame", QUIC_EV_CONN_PRSAFRM, qc, origin);
 		if (origin->pkt) {
 			TRACE_DEVEL("duplicated from packet", QUIC_EV_CONN_PRSAFRM,
-			            qc, NULL, &origin->pkt->pn_node.key);
+			            qc, dup_frm, &origin->pkt->pn_node.key);
 		}
 		else {
 			/* <origin> is a frame which was sent from a packet detected as lost. */
@@ -1326,11 +1326,21 @@ int qc_dgrams_retransmit(struct quic_conn *qc)
 				if (!qc_send_hdshk_pkts(qc, 1, qc->iel, qc->hel))
 					goto leave;
 				/* Put back unsent frames in their packet number spaces */
+				TRACE_DEVEL("Remaining frames", QUIC_EV_CONN_FRMLIST, qc, &ifrms);
+				if (hpktns)
+					TRACE_DEVEL("Remaining frames", QUIC_EV_CONN_FRMLIST, qc, &hfrms);
 				LIST_SPLICE(&ipktns->tx.frms, &ifrms);
 				if (hpktns)
 					LIST_SPLICE(&hpktns->tx.frms, &hfrms);
 			}
 			else {
+				struct quic_frame *frm, *frmback;
+
+				list_for_each_entry_safe(frm, frmback, &hfrms, list) {
+					LIST_DEL_INIT(&frm->ref);
+					LIST_DEL_INIT(&frm->list);
+					qc_frm_free(qc, &frm);
+				}
 				/* We are in the case where the anti-amplification limit will be
 				 * reached after having sent this datagram. There is no need to
 				 * send more than one datagram.