net/http: backport invalid memory address or nil pointer dereference fix?

[gsiems]

Please answer these questions before submitting your issue. Thanks!

What version of Go are you using (go version)?

go version go1.9.2 linux/amd64

Does this issue reproduce with the latest release?

yes

What operating system and processor architecture are you using (go env)?

CentOS 6

GOARCH="amd64"
GOBIN="/home/annsam/go/bin"
GOEXE=""
GOHOSTARCH="amd64"
GOHOSTOS="linux"
GOOS="linux"
GOPATH="/home/annsam/go"
GORACE=""
GOROOT="/home/annsam/bin/go"
GOTOOLDIR="/home/annsam/bin/go/pkg/tool/linux_amd64"
GCCGO="gccgo"
CC="gcc"
GOGCCFLAGS="-fPIC -m64 -pthread -fmessage-length=0 -fdebug-prefix-map=/tmp/go-build210233403=/tmp/go-build"
CXX="g++"
CGO_ENABLED="1"
CGO_CFLAGS="-g -O2"
CGO_CPPFLAGS=""
CGO_CXXFLAGS="-g -O2"
CGO_FFLAGS="-g -O2"
CGO_LDFLAGS="-g -O2"
PKG_CONFIG="pkg-config"

What did you do?

If possible, provide a recipe for reproducing the error.
A complete runnable program is good.
A link on play.golang.org is best.

package main

import (
    "fmt"
    "net/http"
)

func main() {

    // Something about this URL:
    traceRedirects("https://www.bizjournals.com/twincities/morning_roundup/2013/07/richfield-green-lights-25m-car-dealer.html")
    // causes the next URL retrieved to SIGSEGV (doesn't matter what the URL is)
    traceRedirects("https://www.google.com")

}

func traceRedirects(testURL string) {
    nextURL := testURL

    var i int
    for i < 10 {

        client := &http.Client{
            CheckRedirect: func(req *http.Request, via []*http.Request) error {
                return http.ErrUseLastResponse
            }}

        req, err := http.NewRequest("HEAD", nextURL, nil)
        if err != nil {
            fmt.Println(err)
            return
        }

        resp, err := client.Do(req)
        if err != nil {
            fmt.Println(err)
            return
        }
        defer resp.Body.Close()

        fmt.Printf("i: %d, StatusCode: %d: %q", i, resp.StatusCode, resp.Request.URL)

        nextURL = resp.Header.Get("Location")
        if nextURL == "" {
            fmt.Println("Done!")
            return
        }
        i += 1
    }
}

What did you expect to see?

No panics

What did you see instead?

$ ./foo
panic: runtime error: invalid memory address or nil pointer dereference
[signal SIGSEGV: segmentation violation code=0x1 addr=0x30 pc=0x5bb360]

goroutine 29 [running]:
net/http.(*http2pipe).Write(0xc420370ca8, 0xc420560000, 0xb42, 0xb42, 0x0, 0x0, 0x0)
/home/annsam/bin/go/src/net/http/h2_bundle.go:3661 +0x100
net/http.(*http2clientConnReadLoop).processData(0xc420045fb0, 0xc4205a6120, 0xc4205a6120, 0x0)
/home/annsam/bin/go/src/net/http/h2_bundle.go:8259 +0x2ac
net/http.(*http2clientConnReadLoop).run(0xc420045fb0, 0x67ecc8, 0xc420031fb0)
/home/annsam/bin/go/src/net/http/h2_bundle.go:7896 +0x54f
net/http.(*http2ClientConn).readLoop(0xc4200761a0)
/home/annsam/bin/go/src/net/http/h2_bundle.go:7788 +0x9d
created by net/http.(*http2Transport).newClientConn
/home/annsam/bin/go/src/net/http/h2_bundle.go:7053 +0x6b9

[namusyaka]

Thanks for your report.
Indeed, the panic can be reproduced in go-1.9.
The problem has been fixed in #22376, I think.
Actually couldn't reproduce in golang edge version.

[davecheney]

Duplicate of #22376

[namusyaka]

@davecheney @bradfitz Is it not necessary to backport this to 1.9.3?

[bradfitz]

We can keep it open for the decision, but it might not meet the bar since it only affects some HEAD requests and there's a workaround: disabling http2.

[andybons]

CL 88676 OK for Go 1.9.3.

[andybons]

go1.9.3 has been packaged and includes:

• CL 88676 [release-branch.go1.9] net/http: update bundled http2

The release is posted at golang.org/dl.

— golang.org/x/build/cmd/releasebot, Jan 22 21:02:58 UTC