From a3e9a04435b7b1e657baaa575b3ec22ec9dace68 Mon Sep 17 00:00:00 2001 From: Christopher Faulet Date: Fri, 23 Jan 2026 10:05:08 +0100 Subject: [PATCH] BUG/MEDIUM: mux-h1: Skip UNUSED htx block when formating the start line UNUSED blocks were not properly handled when the H1 multiplexer was formatting the start line of a request or a response. UNUSED was ignored but not removed from HTX message. So the mux can loop infinitly on such block. It could be seen a a major issue but in fact it happens only if a very specific case on the reponse processing (at least I think so): the server must send an interim message (a 100-continue for intance) with the final response. HAProxy must receive both in same time and the final reponse must be intercepted (via a http-response return action for instance), In that case, the interim message is fowarded and the server final reponse is removed and replaced by a proxy error message. Now UNUSED htx blocks are properly skipped and removed. This patch must be backported as far as 3.0. --- src/mux_h1.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/src/mux_h1.c b/src/mux_h1.c index 3d88ad8b1..232c9c184 100644 --- a/src/mux_h1.c +++ b/src/mux_h1.c @@ -2488,8 +2488,10 @@ static size_t h1_make_reqline(struct h1s *h1s, struct h1m *h1m, struct htx *htx, goto end; type = htx_get_blk_type(blk); sz = htx_get_blksz(blk); - if (type == HTX_BLK_UNUSED) + if (type == HTX_BLK_UNUSED) { + htx_remove_blk(htx, blk); continue; + } if (type != HTX_BLK_REQ_SL || sz > count) goto error; break; @@ -2577,8 +2579,10 @@ static size_t h1_make_stline(struct h1s *h1s, struct h1m *h1m, struct htx *htx, type = htx_get_blk_type(blk); sz = htx_get_blksz(blk); - if (type == HTX_BLK_UNUSED) + if (type == HTX_BLK_UNUSED) { + htx_remove_blk(htx, blk); continue; + } if (type != HTX_BLK_RES_SL || sz > count) goto error; break; -- 2.47.3