BUG/MEDIUM: applet: Fix transfer of HTX data to the applet

appctx_htx_snd_buf() function is relying on htx_xfer() function to transfer
HTX blocks when a swap of buffers is not possible. However, it was not
properly using this function.

Indeed, originally htx_xfer() was designed to transfer blocks with a limit,
the <count> parameter, which included the blocks payload and the
meta-data. It was aligned with all calls, except for the transfer of HTX
data to the applet, in appctx_htx_snd_buf() function. In that case, the
<count> parameter is the amount of data forwarded by the stream to the
applet. So meta-data are not included.

Thanks to the previous commit ("MEDIUM: htx: Improve htx_xfer API to not count
HTX meta-data"), it is now possible to instruct htx_xfer() function that
<count> parameter does not include the meta-data.

Because of this bug, crashes can be experienced when transferring HTX data
to an applet. At first glance, lua HTTP applets and the http client are
concerned.

Stable versions from 3.3 to 3.0 are also affected. But this patch cannot be
backported as is because htx_xfer() function does not exist on these
versions.

Thaks to Yon Harlicaj for finding and reporting this.
(https://x.com/nvmb3r - https://www.linkedin.com/in/eljon-harlicaj/)

diff --git a/src/applet.c b/src/applet.c
index 8f11535d6aec9a38c4e0f4bf63b6811c1198251b..e1ec9b83778909280b9cf59aede8198926750d2c 100644 (file)
--- a/src/applet.c
+++ b/src/applet.c
@@ -608,7 +608,7 @@ size_t appctx_htx_snd_buf(struct appctx *appctx, struct buffer *buf, size_t coun
                goto end;
        }
 
-       htx_xfer(appctx_htx, buf_htx, count, HTX_XFER_DEFAULT);
+       htx_xfer(appctx_htx, buf_htx, count, HTX_XFER_NO_METADATA);
        if (htx_is_empty(buf_htx)) {
                appctx_htx->flags |= (buf_htx->flags & HTX_FL_EOM);
        }