From: Christopher Faulet <cfaulet@haproxy.com>
Date: Thu, 7 Apr 2022 08:47:07 +0000 (+0200)
Subject: BUG/MINOR: http_client: Don't add input data on an empty request buffer
X-Git-Tag: v2.6-dev5~29
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=dca3b5b2c6618860b305b48b5c55abe2877be832;p=thirdparty%2Fhaproxy.git

BUG/MINOR: http_client: Don't add input data on an empty request buffer

When compiled in debug mode, a BUG_ON triggers an error when the payload is
fully transfered from the http-client buffer to the request channel
buffer. In fact, when channel_add_input() is called, the request buffer is
empty. So an error is reported when those data are directly forwarded,
because we try to add some output data on a buffer with no data.

To fix the bug, we must be sure to call channel_add_input() after the data
transfer.

The bug was introduced by the commit ccc7ee45f ("MINOR: httpclient: enable
request buffering"). So, this patch must be backported if the above commit
is backported.
---

diff --git a/src/http_client.c b/src/http_client.c
index e8d7b05c54..33213a88f5 100644
--- a/src/http_client.c
+++ b/src/http_client.c
@@ -702,13 +702,15 @@ static void httpclient_applet_io_handler(struct appctx *appctx)
 							goto more;
 
 						if (htx_is_empty(htx)) {
+							size_t data = hc_htx->data;
+
 							/* Here htx_to_buf() will set buffer data to 0 because
 							 * the HTX is empty, and allow us to do an xfer.
 							 */
 							htx_to_buf(hc_htx, &hc->req.buf);
 							htx_to_buf(htx, &req->buf);
-							channel_add_input(req, hc_htx->data);
 							b_xfer(&req->buf, &hc->req.buf, b_data(&hc->req.buf));
+							channel_add_input(req, data);
 						} else {
 							struct htx_ret ret;