From: Willy Tarreau <w@1wt.eu>
Date: Tue, 9 Apr 2019 14:21:54 +0000 (+0200)
Subject: BUG/MEDIUM: htx: fix random premature abort of data transfers
X-Git-Tag: v2.0-dev3~329
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=90caa07935651b5b9ece3606d19ba5d7d45c46e8;p=thirdparty%2Fhaproxy.git

BUG/MEDIUM: htx: fix random premature abort of data transfers

It can happen in some cases that the last block of an H2 transfer over
HTX is truncated. This was tracked down to a leftover of an earlier
implementation of htx_xfer_blks() causing the computed size of a block
to be incorrectly calculated if a data block doesn't completely fit into
the target buffer. In practice it causes the EOM block to be attempted to
be emitted with a wrong size and the message to be truncated. One way to
reproduce this is to chain two haproxy instances in h1->h2->h1 with
httpterm as the server and h2load as the client, making many requests
between 8 and 10kB over a single connection. Usually one of the very
first requests will fail.

This fix must be backported to 1.9.
---

diff --git a/src/htx.c b/src/htx.c
index 892bbd6e5f..de879260a7 100644
--- a/src/htx.c
+++ b/src/htx.c
@@ -519,8 +519,8 @@ struct htx_ret htx_xfer_blks(struct htx *dst, struct htx *src, uint32_t count,
 		max = htx_free_data_space(dst);
 		if (max > count)
 			max = count;
-		if (ret + sz > max) {
-			sz = max - ret;
+		if (sz > max) {
+			sz = max;
 			info = (type << 28) + sz;
 			/* Headers and pseudo headers must be fully copied  */
 			if (type < HTX_BLK_DATA || !sz)