mirrors/haproxy
1
0
Fork 0
mirror of https://git.haproxy.org/git/haproxy.git/ synced 2025-11-28 14:21:00 +01:00
Code Issues Projects Releases Wiki Activity

BUG/MEDIUM: httpclient/lua: crash because of b_xfer and get_trash_chunk()

Browse Source 
When using the lua httpclient, haproxy could crash because a b_xfer is
done in httpclient_xfer, which will do a zero-copy swap of the data in
the buffers. The ptr will then be free() by the pool.

However this can't work with a trash buffer, because the area was not
allocated from the pool buffer, so the pool is not suppose to free it
because it does not know this ptr, using -DDEBUG_MEMORY_POOLS will
result with a crash during the free.

Fix the problem by using b_force_xfer() instead of b_xfer which copy
the data instead. The problem still exist with the trash however, and
the trash API must be reworked.
This commit is contained in:
William Lallemand 2021-09-30 10:07:57 +02:00
parent f77f1de802
commit 4d60184887
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
src/http_client.c
View File

@ -311,7 +311,7 @@ int httpclient_res_xfer(struct httpclient *hc, struct buffer *dst)
{ {
int ret; int ret;
ret = b_xfer(dst, &hc->res.buf, MIN(1024, b_data(&hc->res.buf))); ret = b_force_xfer(dst, &hc->res.buf, MIN(1024, b_data(&hc->res.buf)));
/* call the client once we consumed all data */ /* call the client once we consumed all data */
if (!b_data(&hc->res.buf) && hc->appctx) if (!b_data(&hc->res.buf) && hc->appctx)
appctx_wakeup(hc->appctx); appctx_wakeup(hc->appctx);