BUG/MEDIUM: stats: disable request analyser when processing POST or HEAD

After the response headers are sent and the request processing is done,
the buffers are wiped out and the stream interface is closed. We must
then disable the request analysers, otherwise some processing will
happen on a closed stream interface and empty buffers which do not
match, causing all sort of crashes. This issue was introduced with
recent work on the stats, and was reported by Seri.

diff --git a/src/proto_http.c b/src/proto_http.c
index 3b5a478a204ba448d2f7eb9aa72aa96d82955efb..69ef88136f10c7939f4ac98bbdbeeade8c85d92c 100644 (file)
--- a/src/proto_http.c
+++ b/src/proto_http.c
@@ -2929,7 +2929,8 @@ int http_process_req_stat_post(struct stream_interface *si, struct http_txn *txn
 
 /* This function checks whether we need to enable a POST analyser to parse a
  * stats request, and also registers the stats I/O handler. It returns zero
- * if it needs to come back again, otherwise non-zero if it finishes.
+ * if it needs to come back again, otherwise non-zero if it finishes. In the
+ * latter case, it also clears the request analysers.
  */
 int http_handle_stats(struct session *s, struct channel *req)
 {
@@ -3012,6 +3013,7 @@ int http_handle_stats(struct session *s, struct channel *req)
                        s->flags |= SN_ERR_PRXCOND; // to mark that it comes from the proxy
                if (!(s->flags & SN_FINST_MASK))
                        s->flags |= SN_FINST_R;
+               req->analysers = 0;
                return 1;
        }
 
@@ -3045,6 +3047,7 @@ int http_handle_stats(struct session *s, struct channel *req)
                /* that's all we return in case of HEAD request, so let's immediately close. */
                stream_int_retnclose(req->prod, &trash);
                s->target = &http_stats_applet.obj_type; /* just for logging the applet name */
+               req->analysers = 0;
                return 1;
        }
 
@@ -3057,7 +3060,6 @@ int http_handle_stats(struct session *s, struct channel *req)
        s->rep->prod->conn->xprt_ctx = s;
        s->rep->prod->applet.st0 = s->rep->prod->applet.st1 = 0;
        req->analysers = 0;
-
        return 1;
 }