# Request pool freed while still referenced

Pool or stream object freed on shutdown/early push while protocol layer still holds a pointer

_Area: Memory corruption and native code. Seen in 3 disclosed reports; latest 2019-10-15. Updated 2026-11-01._

## How it works
Apache httpd hands out memory from per-request and per-connection *pools*. A pool is freed as a unit when its owner (a request, a connection, a shutdown path) is done. The bug class is a lifetime mismatch: one component frees the pool while another component still holds a pointer into it and later reads or writes through that pointer. In mod_http2 the two owners are mod_http2 itself (which owns the stream/request pools) and nghttp2 (which keeps its own references to streams). When shutdown or an early push destroys the pool before nghttp2 drops its reference, the next frame send or string build touches freed heap [E1](https://bugbountylibrary.com/r/h1%3A680415.md)[E2](https://bugbountylibrary.com/r/h1%3A677557.md)[E3](https://bugbountylibrary.com/r/h1%3A527042.md). The broken assumption is "whoever frees the pool also knows every remaining reference." That is false across a library boundary.

## Where it shows up
- Shutdown/teardown paths that call a destroy/free on a stream or request while a library callback may still fire [E1](https://bugbountylibrary.com/r/h1%3A680415.md).
- Early push handling that writes into the *pushing* request's pool before that request's lifetime is settled [E2](https://bugbountylibrary.com/r/h1%3A677557.md).
- Scoreboard or logging code that formats request strings (`sprintf`-style) from `r->the_request` or similar after the request pool is gone [E3](https://bugbountylibrary.com/r/h1%3A527042.md).
- Any place a host module stores a pointer that a third-party library (nghttp2) also references, with no shared refcount.
- Pool settings that free aggressively (e.g. `MaxMemFree 1`) making the window easy to hit.

## How to review
The invariant: **no pointer into a pool may be dereferenced after that pool is destroyed, and no library may retain a reference to a host-owned object past the host's free.**
- For each `*_destroy`/pool-free call, list every component that could still hold a pointer (library callbacks, queued frames, scoreboard, deferred logging) and confirm each is quiesced first.
- Check ordering: is the library told to release the stream *before* the pool is freed, on every path including error and shutdown?
- Confirm string-formatting and logging paths run while the request pool is still alive.
- Treat aggressive pool settings as a review aid, not a fix.

## How finders spotted it
- Fuzzed network input against an ASAN httpd build with `MaxMemFree 1` to force immediate pool frees and surface lifetime crashes in HTTP/2 handling [E1](https://bugbountylibrary.com/r/h1%3A680415.md).
- Noticed ASAN faulting addresses were ASCII strings, a hint that freed pool memory holding header values was being reused [E2](https://bugbountylibrary.com/r/h1%3A677557.md).
- Built httpd with ASAN and crafted HTTP/2 requests to exercise scoreboard/request-pool lifetime, catching the stale read in ASAN output [E3](https://bugbountylibrary.com/r/h1%3A527042.md).

## Variants seen
- Library retains stream reference across shutdown; host frees it; later frame send reads freed memory [E1](https://bugbountylibrary.com/r/h1%3A680415.md).
- Early push overwrites the pushing request's pool; freed pool reused, giving use-after-free [E2](https://bugbountylibrary.com/r/h1%3A677557.md).
- Stale request data fed into `sprintf` after pool destruction, poisoning `r->the_request` [E3](https://bugbountylibrary.com/r/h1%3A527042.md).

## Impact and severity
Remote, often unauthenticated crashes of Apache httpd; E2 notes potential code execution [E1](https://bugbountylibrary.com/r/h1%3A680415.md)[E2](https://bugbountylibrary.com/r/h1%3A677557.md)[E3](https://bugbountylibrary.com/r/h1%3A527042.md). Impact rises because the bug sits in default HTTP/2 handling reachable by any client, and because freed pool memory is reused for attacker-influenced header strings, turning a read into controllable corruption [E2](https://bugbountylibrary.com/r/h1%3A677557.md).

## Evidence
- E1: https://bugbountylibrary.com/r/h1%3A680415.md
- E2: https://bugbountylibrary.com/r/h1%3A677557.md
- E3: https://bugbountylibrary.com/r/h1%3A527042.md