From: Christopher Faulet <cfaulet@haproxy.com>
Date: Thu, 20 Jul 2017 09:05:10 +0000 (+0200)
Subject: BUG/MAJOR: http: Fix possible infinity loop in http_sync_(req|res)_state
X-Git-Tag: v1.8-dev3~221
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=56d260916f61e48c8b2f1fd2f9431afac776d160;p=thirdparty%2Fhaproxy.git

BUG/MAJOR: http: Fix possible infinity loop in http_sync_(req|res)_state

In commit "MINOR: http: Switch requests/responses in TUNNEL mode only by
checking txn flags", it is possible to have an infinite loop on HTTP_MSG_CLOSING
state.
---

diff --git a/src/proto_http.c b/src/proto_http.c
index f9dc8a1b44..e72e7e9620 100644
--- a/src/proto_http.c
+++ b/src/proto_http.c
@@ -5413,8 +5413,8 @@ int http_sync_req_state(struct stream *s)
 		else if (chn->flags & CF_SHUTW) {
 			txn->req.err_state = txn->req.msg_state;
 			txn->req.msg_state = HTTP_MSG_ERROR;
-			goto wait_other_side;
 		}
+		goto wait_other_side;
 	}
 
 	if (txn->req.msg_state == HTTP_MSG_CLOSED) {
@@ -5542,8 +5542,8 @@ int http_sync_res_state(struct stream *s)
 			s->be->be_counters.cli_aborts++;
 			if (objt_server(s->target))
 				objt_server(s->target)->counters.cli_aborts++;
-			goto wait_other_side;
 		}
+		goto wait_other_side;
 	}
 
 	if (txn->rsp.msg_state == HTTP_MSG_CLOSED) {