From: Willy Tarreau <w@1wt.eu>
Date: Wed, 3 Apr 2024 07:25:43 +0000 (+0200)
Subject: BUG/MAJOR: applet: fix a MIN vs MAX usage in appctx_raw_rcv_buf()
X-Git-Tag: v3.0-dev7~33
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=1ea18fa8a3ab961ea43610e22dda3c87e8f2a67a;p=thirdparty%2Fhaproxy.git

BUG/MAJOR: applet: fix a MIN vs MAX usage in appctx_raw_rcv_buf()

The MAX() macro was used to limit the count of bytes to be transferred
in appctx_raw_rcv_buf() by commit ee53d8421f ("MEDIUM: applet: Simplify
a bit API to exchange data with applets") instead of MIN(). It didn't
seem to have any consequences until commit f37ddbeb4b ("MAJOR: cli:
Update the CLI applet to handle its own buffers") that triggers a BUG_ON()
in __b_putblk() when the other side is slow to read, because we're trying
to append a full buffer on top of a non-empty one. A way to reproduce it
is to dump a heavy stick table on the CLI with a screen scrolling.

No backport is needed since this was introduced in 3.0-dev3 and revealed
after dev5 only.
---

diff --git a/src/applet.c b/src/applet.c
index 8e7ac445b7..d1526ef896 100644
--- a/src/applet.c
+++ b/src/applet.c
@@ -516,7 +516,7 @@ size_t appctx_htx_rcv_buf(struct appctx *appctx, struct buffer *buf, size_t coun
 
 size_t appctx_raw_rcv_buf(struct appctx *appctx, struct buffer *buf, size_t count, unsigned int flags)
 {
-	return b_xfer(buf, &appctx->outbuf, MAX(count, b_data(&appctx->outbuf)));
+	return b_xfer(buf, &appctx->outbuf, MIN(count, b_data(&appctx->outbuf)));
 }
 
 size_t appctx_rcv_buf(struct stconn *sc, struct buffer *buf, size_t count, unsigned int flags)