Author: Alex Rousskov <rousskov@measurement-factory.com>

Bug 2791: assertion failed: MemBuf.cc:400: new_cap > (size_t) capacity

Limit input buffer reads to the avilable space.

diff --git a/src/Server.cc b/src/Server.cc
index 476dfd81536ca9c8f4bd086edfe9a57e0b4d0239..a34879f4b541620e54ac6a00d7b5eb8a2f366e0e 100644 (file)
--- a/src/Server.cc
+++ b/src/Server.cc
@@ -717,8 +717,15 @@ ServerStateData::storeReplyBody(const char *data, ssize_t len)
     currentOffset += len;
 }
 
-size_t ServerStateData::replyBodySpace(size_t space)
+size_t ServerStateData::replyBodySpace(const MemBuf &readBuf,
+                                       const size_t minSpace) const
 {
+    size_t space = readBuf.spaceSize(); // available space w/o heroic measures
+    if (space < minSpace) {
+        const size_t maxSpace = readBuf.potentialSpaceSize(); // absolute best
+        space = min(minSpace, maxSpace); // do not promise more than asked
+    }
+
 #if ICAP_CLIENT
     if (responseBodyBuffer) {
        return 0;       // Stop reading if already overflowed waiting for ICAP to catch up

diff --git a/src/Server.h b/src/Server.h
index e0aeb0b5c000d249e080ca35897dc4941d9fc324..9f18ae16090ebcc19ad5cada7e67ea27f8a196d2 100644 (file)
--- a/src/Server.h
+++ b/src/Server.h
@@ -160,7 +160,7 @@ protected:
     void adaptOrFinalizeReply();
     void addVirginReplyBody(const char *buf, ssize_t len);
     void storeReplyBody(const char *buf, ssize_t len);
-    size_t replyBodySpace(size_t space = 4096 * 10);
+    size_t replyBodySpace(const MemBuf &readBuf, const size_t minSpace) const;
 
     // These should be private
     int64_t currentOffset;     // Our current offset in the StoreEntry

diff --git a/src/ftp.cc b/src/ftp.cc
index 9dc43bbca5d42a69c32c99eb0bf3c46eea404eef..3545ee6b264ce7f7b2996751e8338c17feb0e72c 100644 (file)
--- a/src/ftp.cc
+++ b/src/ftp.cc
@@ -1204,7 +1204,7 @@ FtpStateData::maybeReadVirginBody()
     if (data.read_pending)
         return;
 
-    int read_sz = replyBodySpace(data.readBuf->spaceSize());
+    const int read_sz = replyBodySpace(*data.readBuf, 0);
 
     debugs(11,9, HERE << "FTP may read up to " << read_sz << " bytes");
 

diff --git a/src/http.cc b/src/http.cc
index 644a8f25682adfa9ea6a20a3699f6e7d5416111a..1c8d2dba7a338607744734a4d65f902ad4ad2515 100644 (file)
--- a/src/http.cc
+++ b/src/http.cc
@@ -1248,7 +1248,9 @@ HttpStateData::processReplyBody()
 void
 HttpStateData::maybeReadVirginBody()
 {
-    int read_sz = replyBodySpace(readBuf->spaceSize());
+    // we may need to grow the buffer if headers do not fit
+    const int minRead = flags.headers_parsed ? 0 :1024;
+    const int read_sz = replyBodySpace(*readBuf, minRead);
 
     debugs(11,9, HERE << (flags.do_next_read ? "may" : "wont") <<
            " read up to " << read_sz << " bytes from FD " << fd);
@@ -1261,12 +1263,8 @@ HttpStateData::maybeReadVirginBody()
      * handler until we get a notification from someone that
      * its okay to read again.
      */
-    if (read_sz < 2) {
-       if (flags.headers_parsed)
-           return;
-       else
-           read_sz = 1024;
-    }
+    if (read_sz < 2)
+        return;
 
     if (flags.do_next_read) {
        flags.do_next_read = 0;