BUG/MEDIUM: mux-h1: Handle h1_process() failures on a pipelined request

On frontend side, when a conn-stream is detached from a H1 connection, the
H1 stream is destroyed and if we already have some data to parse (a
pipelined request), we process these data immedialtely calling
h1_process(). Then we adjust the H1 connection timeout. But h1_process() may
fail and release the H1 connection. For instance, a parsing error may be
reported. Thus, when that happens, we must not use anymore the H1 connection
and exit.

This patch must be backported as far as the 2.2. This bug can impact the 2.3
and the 2.2, in theory, if h1 stream creation fails. But, concretly, it only
fails on the 2.4 because the requests are now parsed at this step.

diff --git a/src/mux_h1.c b/src/mux_h1.c
index 885269909cab757a1e891d9bd9362bd1b86d471b..65581589d728c217574774fb05019d69fc808134 100644 (file)
--- a/src/mux_h1.c
+++ b/src/mux_h1.c
@@ -2782,8 +2782,10 @@ static void h1_detach(struct conn_stream *cs)
                        /* If we have a new request, process it immediately or
                         * subscribe for reads waiting for new data
                         */
-                       if (unlikely(b_data(&h1c->ibuf)))
-                               h1_process(h1c);
+                       if (unlikely(b_data(&h1c->ibuf))) {
+                               if (h1_process(h1c) == -1)
+                                       goto end;
+                       }
                        else
                                h1c->conn->xprt->subscribe(h1c->conn, h1c->conn->xprt_ctx, SUB_RETRY_RECV, &h1c->wait_event);
                }