mirrors/haproxy
1
0
Fork 0
mirror of https://git.haproxy.org/git/haproxy.git/ synced 2026-05-04 12:41:00 +02:00
Code Issues Projects Releases Wiki Activity

BUG/MEDIUM: spoe: Acquire context buffer in applet before consuming a frame

Browse Source 
Changes brought to support large buffers revealed a bug in the SPOE applet
when a frame is copied in the SPOE context buffer. A b_xfer() was performed
without allocating the SPOE context buffer. It is not expected. As stated in
the function documentation, the caller is responsible for ensuring there is
enough space in the destination buffer. So first of all, it must ensure this
buffer was allocated.

With recent changes, we are able to hit a BUG_ON() because the swap is no
longer possible if source and destination buffers size are not the same.

This patch should fix the issue #3286. It could be backported as far as 3.1.
This commit is contained in:
Christopher Faulet 2026-02-23 14:31:17 +01:00
parent bbd8492c22
commit c2b5446292
1 changed files with 3 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
src/flt_spoe.c
View File

@ -467,6 +467,9 @@ static int spoe_handle_receiving_frame_appctx(struct appctx *appctx)
goto end;
}
if (!spoe_acquire_buffer(&spoe_ctx->buffer, &spoe_ctx->buffer_wait))
goto end;
if (b_data(&appctx->inbuf) > spoe_appctx->agent->max_frame_size) {
spoe_ctx->state = SPOE_CTX_ST_ERROR;
spoe_ctx->status_code = (spoe_appctx->status_code + 0x100);