From: Christopher Faulet Date: Wed, 14 May 2025 07:22:45 +0000 (+0200) Subject: BUG/MEDIUM: mux-spop: Properly detect truncated frames on demux to report error X-Git-Tag: v3.2-dev16~12 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=16314bb93c2c2c47c648da880ab55bf2ac01d9d4;p=thirdparty%2Fhaproxy.git BUG/MEDIUM: mux-spop: Properly detect truncated frames on demux to report error There was no test in the demux part to detect truncated frames and to report an error at the connection level. The SPOP streams were properly switch to half-closed state. But waiting the associated SPOE applets were woken up and released, the SPOP connection could be woken up several times for nothing. I never triggered the watchdog in that case, but it is not excluded. Now, at the end of the demux function, if a specific test was added to detect truncated frames to report an error and close the connection. This patch must be backported to 3.1. --- diff --git a/src/mux_spop.c b/src/mux_spop.c index 2a5002d99..7b00087c7 100644 --- a/src/mux_spop.c +++ b/src/mux_spop.c @@ -2272,6 +2272,13 @@ static void spop_process_demux(struct spop_conn *spop_conn) spop_conn->flags |= SPOP_CF_END_REACHED; } + if (spop_conn_read0_pending(spop_conn) && (spop_conn->flags & SPOP_CF_DEM_SHORT_READ) && b_data(&spop_conn->dbuf)) { + spop_conn_error(spop_conn, SPOP_ERR_INVALID); + spop_conn->state = SPOP_CS_CLOSED; + TRACE_ERROR("truncated data", SPOP_EV_RX_FRAME|SPOP_EV_RX_FHDR|SPOP_EV_SPOP_CONN_ERR, spop_conn->conn); + TRACE_STATE("switching to CLOSED", SPOP_EV_RX_FRAME|SPOP_EV_RX_FHDR|SPOP_EV_SPOP_CONN_ERR, spop_conn->conn); + } + if (spop_conn->flags & SPOP_CF_ERROR) spop_conn_report_term_evt(spop_conn, ((eb_is_empty(&spop_conn->streams_by_id) && (spop_conn->state == SPOP_CS_RUNNING) && spop_conn->dsi == -1) ? muxc_tevt_type_rcv_err