From: Christopher Faulet <cfaulet@haproxy.com>
Date: Fri, 18 Dec 2020 14:13:47 +0000 (+0100)
Subject: BUG/MEDIUM: mux-h1: Handle h1_process() failures on a pipelined request
X-Git-Tag: v2.4-dev4~13
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=0c366a87619206d1bf1c9f69698933d0e58b7be5;p=thirdparty%2Fhaproxy.git

BUG/MEDIUM: mux-h1: Handle h1_process() failures on a pipelined request

On frontend side, when a conn-stream is detached from a H1 connection, the
H1 stream is destroyed and if we already have some data to parse (a
pipelined request), we process these data immedialtely calling
h1_process(). Then we adjust the H1 connection timeout. But h1_process() may
fail and release the H1 connection. For instance, a parsing error may be
reported. Thus, when that happens, we must not use anymore the H1 connection
and exit.

This patch must be backported as far as the 2.2. This bug can impact the 2.3
and the 2.2, in theory, if h1 stream creation fails. But, concretly, it only
fails on the 2.4 because the requests are now parsed at this step.
---

diff --git a/src/mux_h1.c b/src/mux_h1.c
index 885269909c..65581589d7 100644
--- a/src/mux_h1.c
+++ b/src/mux_h1.c
@@ -2782,8 +2782,10 @@ static void h1_detach(struct conn_stream *cs)
 			/* If we have a new request, process it immediately or
 			 * subscribe for reads waiting for new data
 			 */
-			if (unlikely(b_data(&h1c->ibuf)))
-				h1_process(h1c);
+			if (unlikely(b_data(&h1c->ibuf))) {
+				if (h1_process(h1c) == -1)
+					goto end;
+			}
 			else
 				h1c->conn->xprt->subscribe(h1c->conn, h1c->conn->xprt_ctx, SUB_RETRY_RECV, &h1c->wait_event);
 		}