WtStreamManager fix uaf

Summary: fixes a uaf when accessing a write handle that has been destroyed after dequeuing a fin

Reviewed By: joanna-jo

Differential Revision: D90117497

fbshipit-source-id: 15f087b82518df18b77f6cf0d320d245985069cf

Author: hanidamlaj

third-party/proxygen/src/proxygen/lib/http/webtransport/WtStreamManager.cpp

@@ -593,8 +593,8 @@ StreamData WtStreamManager::dequeue(WtWriteHandle& wh,
   connSendFc_.commit(len);
 
   // Connection FC blocked if we have data but conn window is exhausted
-  if (connSendFc_.getAvailable() == 0 &&
-      writeHandle.bufferedSendData_.hasData()) {
+  const bool hasData = !res.fin && writeHandle.bufferedSendData_.hasData();
+  if (connSendFc_.getAvailable() == 0 && hasData) {
     connFcBlockedStreams_.insert(&wh);
   }
 

third-party/proxygen/src/proxygen/lib/http/webtransport/test/WtStreamManagerTest.cpp

@@ -351,6 +351,27 @@ TEST(WtStreamManager, WriteEgressHandle) {
   EXPECT_TRUE(dequeue.fin);
 }
 
+TEST(WtStreamManager, DequeueWriteConnFcBlocked) {
+  WtConfig config{.peerMaxStreamsUni = 1};
+  WtSmEgressCb egressCb;
+  WtSmIngressCb ingressCb;
+  auto priorityQueue = std::make_unique<quic::HTTPPriorityQueue>();
+  WtStreamManager streamManager{
+      detail::WtDir::Client, config, egressCb, ingressCb, *priorityQueue};
+
+  auto uni = CHECK_NOTNULL(streamManager.createEgressHandle());
+  // write kBufLen & fin into stream (fills egress buffer)
+  constexpr auto kBufLen = 65'535;
+  auto res = uni->writeStreamData(
+      makeBuf(kBufLen), /*fin=*/true, /*byteEventCallback=*/nullptr);
+  EXPECT_TRUE(res.hasValue() && *res == WebTransport::FCState::BLOCKED);
+
+  // we should be able to dequeue kBufLen data from one.writeHandle
+  expectNextWritable(priorityQueue.get(), uni->getID());
+  auto dequeue = streamManager.dequeue(*uni, /*atMost=*/kBufLen);
+  EXPECT_TRUE(dequeue.data && dequeue.fin);
+}
+
 TEST(WtStreamManager, BidiHandleCancellation) {
   WtConfig config{};
   WtSmEgressCb egressCb;