From: Willy Tarreau <w@1wt.eu>
Date: Mon, 25 Jan 2010 19:39:51 +0000 (+0100)
Subject: [CRITICAL] buffers: buffer_insert_line2 must not change the ->w entry
X-Git-Tag: v1.4-dev8~4
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=c5bbe53f6f86efac2d28d4443d1c2da35948442b;p=thirdparty%2Fhaproxy.git

[CRITICAL] buffers: buffer_insert_line2 must not change the ->w entry

Krzysztof Oledzki reported that 1.4-dev7 would regularly crash
on an apparently very common workload. The cores he provided
showed some inter-buffer data corruption, exactly similar to
what was fixed by the following recent commit :

bbfa7938bd74adbfa435f26503fc10f5938195a3 [BUG] buffer_replace2 must never change the ->w entry

In fact, it was buffer_insert_line2() which was still modifying the
->w pointer, causing issues with pipelined responses in keep-alive
mode if some headers were to be added.

The bug requires a remote client, a near server, large server buffers
and small client buffers to be reproduced, with response header
insertion. Still, it's surprizing that it did not trigger earlier.

Now after 100k pipelined requests it did not trigger anymore.
---

diff --git a/src/buffers.c b/src/buffers.c
index 9aa8c3d115..5f3cc2c440 100644
--- a/src/buffers.c
+++ b/src/buffers.c
@@ -287,7 +287,6 @@ int buffer_insert_line2(struct buffer *b, char *pos, const char *str, int len)
 
 	/* we only move data after the displaced zone */
 	if (b->r  > pos) b->r  += delta;
-	if (b->w  > pos) b->w  += delta;
 	if (b->lr > pos) b->lr += delta;
 	b->l += delta;