1 files changed, 19 insertions, 6 deletions

diff --git a/ot_http.c b/ot_http.c
index dcf634f..fca9176 100644
--- a/ot_http.c
+++ b/ot_http.c
@@ -158,6 +158,13 @@ ssize_t http_sendiovecdata(const int64 sock, struct ot_workstruct *ws, size_t io
     HTTPERROR_500;
   }
 
+  /* Descriptor numbers get recycled, so a result can only belong to this
+     connection if this connection is in fact waiting for one. */
+  if (!(cookie->flag & (STRUCT_HTTP_FLAG_WAITINGFORTASK | STRUCT_HTTP_FLAG_CHUNKED_IN_TRANSFER))) {
+    iovec_free(&iovec_entries, &iovector);
+    return 0;
+  }
+
   /* If this socket collected request in a buffer, free it now */
   buf_reset(&cookie->request);
 
@@ -267,12 +274,16 @@ static ssize_t http_handle_stats(const int64 sock, struct ot_workstruct *ws, cha
                                                 {"url", TASK_FULLSCRAPE_TPB_URLENCODED},  {"txt", TASK_FULLSCRAPE_TPB_ASCII},
                                                 {"txtp", TASK_FULLSCRAPE_TPB_ASCII_PLUS}, {NULL, -3}};
 
-  int mode = TASK_STATS_PEERS, scanon = 1, format = 0;
-
-#ifdef WANT_RESTRICT_STATS
   struct http_data *cookie = io_getcookie(sock);
+  int               mode = TASK_STATS_PEERS, scanon = 1, format = 0;
 
-  if (!cookie || !accesslist_is_blessed(cookie->ip, OT_PERMISSION_MAY_STAT))
+  /* A socket without one is a dead socket, which is what http_sendiovecdata
+     already answers 500 to. */
+  if (!cookie)
+    HTTPERROR_500;
+
+#ifdef WANT_RESTRICT_STATS
+  if (!accesslist_is_blessed(cookie->ip, OT_PERMISSION_MAY_STAT))
     HTTPERROR_403_IP;
 #endif
 
@@ -306,8 +317,7 @@ static ssize_t http_handle_stats(const int64 sock, struct ot_workstruct *ws, cha
   }
 
   if (mode == TASK_STATS_TPB) {
-    struct http_data *cookie = io_getcookie(sock);
-    tai6464           t;
+    tai6464 t;
 #ifdef WANT_COMPRESSION_GZIP
     ws->request[ws->request_size - 1] = 0;
 #ifndef WANT_COMPRESSION_GZIP_ALWAYS
@@ -334,6 +344,9 @@ static ssize_t http_handle_stats(const int64 sock, struct ot_workstruct *ws, cha
   /* default format for now */
   if ((mode & TASK_CLASS_MASK) == TASK_STATS) {
     tai6464 t;
+
+    cookie->flag |= STRUCT_HTTP_FLAG_WAITINGFORTASK;
+
     /* Complex stats also include expensive memory debugging tools */
     taia_uint(&t, 0);
     io_timeout(sock, t);