BUG/MEDIUM: spoe: Acquire context buffer in applet before consuming a frame

Changes brought to support large buffers revealed a bug in the SPOE applet
when a frame is copied in the SPOE context buffer. A b_xfer() was performed
without allocating the SPOE context buffer. It is not expected. As stated in
the function documentation, the caller is responsible for ensuring there is
enough space in the destination buffer. So first of all, it must ensure this
buffer was allocated.

With recent changes, we are able to hit a BUG_ON() because the swap is no
longer possible if source and destination buffers size are not the same.

This patch should fix the issue #3286. It could be backported as far as 3.1.

diff --git a/src/flt_spoe.c b/src/flt_spoe.c
index a1147665ab77acc83a2350178c93b83172f9d1b0..46a46cb3b70892a5226bb0c94d64b2a22b80042a 100644 (file)
--- a/src/flt_spoe.c
+++ b/src/flt_spoe.c
@@ -467,6 +467,9 @@ static int spoe_handle_receiving_frame_appctx(struct appctx *appctx)
                goto end;
        }
 
+       if (!spoe_acquire_buffer(&spoe_ctx->buffer, &spoe_ctx->buffer_wait))
+               goto end;
+
        if (b_data(&appctx->inbuf) > spoe_appctx->agent->max_frame_size) {
                spoe_ctx->state = SPOE_CTX_ST_ERROR;
                spoe_ctx->status_code = (spoe_appctx->status_code + 0x100);