mirrors/haproxy
1
0
Fork 0
mirror of https://git.haproxy.org/git/haproxy.git/ synced 2025-09-23 23:01:24 +02:00
Code Issues Projects Releases Wiki Activity

BUG/MEDIUM: htx: fix random premature abort of data transfers

Browse Source 
It can happen in some cases that the last block of an H2 transfer over
HTX is truncated. This was tracked down to a leftover of an earlier
implementation of htx_xfer_blks() causing the computed size of a block
to be incorrectly calculated if a data block doesn't completely fit into
the target buffer. In practice it causes the EOM block to be attempted to
be emitted with a wrong size and the message to be truncated. One way to
reproduce this is to chain two haproxy instances in h1->h2->h1 with
httpterm as the server and h2load as the client, making many requests
between 8 and 10kB over a single connection. Usually one of the very
first requests will fail.

This fix must be backported to 1.9.
This commit is contained in:
Willy Tarreau 2019-04-09 16:21:54 +02:00
parent 3ca18bf0bd
commit 90caa07935
1 changed files with 2 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
src/htx.c
View File

@ -519,8 +519,8 @@ struct htx_ret htx_xfer_blks(struct htx *dst, struct htx *src, uint32_t count,
max = htx_free_data_space(dst);
if (max > count)
max = count;
if (ret + sz > max) {
sz = max - ret;
if (sz > max) {
sz = max;
info = (type << 28) + sz;
/* Headers and pseudo headers must be fully copied */
if (type < HTX_BLK_DATA || !sz)