From: Christopher Faulet <cfaulet@haproxy.com>
Date: Fri, 17 May 2019 07:58:45 +0000 (+0200)
Subject: BUG/MEDIUM: proto-htx: Not forward too much data when 1xx reponses are handled
X-Git-Tag: v2.0-dev5~82
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=f90c24d14c6ea541717d92d140f2b4c3f3795117;p=thirdparty%2Fhaproxy.git

BUG/MEDIUM: proto-htx: Not forward too much data when 1xx reponses are handled

When an 1xx reponse is processed, we forward it immediatly. But another message
may already be in the channel's buffer, waiting to be processed. This may be
another 1xx reponse or the final one. So instead of forwarding everything, we
must take care to only forward the processed 1xx response.

This patch must be backported to 1.9.
---

diff --git a/src/proto_htx.c b/src/proto_htx.c
index 77464c0d1b..8838fd77cb 100644
--- a/src/proto_htx.c
+++ b/src/proto_htx.c
@@ -1716,8 +1716,17 @@ int htx_wait_for_response(struct stream *s, struct channel *rep, int an_bit)
 	 */
 	if (txn->status < 200 &&
 	    (txn->status == 100 || txn->status >= 102)) {
+		int32_t pos;
+
 		FLT_STRM_CB(s, flt_http_reset(s, msg));
-		c_adv(rep, htx->data);
+		for (pos = htx_get_head(htx); pos != -1; pos = htx_get_next(htx, pos)) {
+			struct htx_blk *blk = htx_get_blk(htx, pos);
+			enum htx_blk_type type = htx_get_blk_type(blk);
+
+			c_adv(rep, htx_get_blksz(blk));
+			if (type == HTX_BLK_EOM)
+				break;
+		}
 		msg->msg_state = HTTP_MSG_RPBEFORE;
 		txn->status = 0;
 		s->logs.t_data = -1; /* was not a response yet */