From: Christopher Faulet <cfaulet@haproxy.com>
Date: Wed, 20 May 2026 13:34:43 +0000 (+0200)
Subject: BUG/MEDIUM: applet: Fix transfer of HTX data to the applet
X-Git-Tag: v3.4-dev13~6
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=2a876290528ef8a71401dc51778527ef59266de7;p=thirdparty%2Fhaproxy.git

BUG/MEDIUM: applet: Fix transfer of HTX data to the applet

appctx_htx_snd_buf() function is relying on htx_xfer() function to transfer
HTX blocks when a swap of buffers is not possible. However, it was not
properly using this function.

Indeed, originally htx_xfer() was designed to transfer blocks with a limit,
the <count> parameter, which included the blocks payload and the
meta-data. It was aligned with all calls, except for the transfer of HTX
data to the applet, in appctx_htx_snd_buf() function. In that case, the
<count> parameter is the amount of data forwarded by the stream to the
applet. So meta-data are not included.

Thanks to the previous commit ("MEDIUM: htx: Improve htx_xfer API to not count
HTX meta-data"), it is now possible to instruct htx_xfer() function that
<count> parameter does not include the meta-data.

Because of this bug, crashes can be experienced when transferring HTX data
to an applet. At first glance, lua HTTP applets and the http client are
concerned.

Stable versions from 3.3 to 3.0 are also affected. But this patch cannot be
backported as is because htx_xfer() function does not exist on these
versions.

Thaks to Yon Harlicaj for finding and reporting this.
(https://x.com/nvmb3r - https://www.linkedin.com/in/eljon-harlicaj/)
---

diff --git a/src/applet.c b/src/applet.c
index 8f11535d6..e1ec9b837 100644
--- a/src/applet.c
+++ b/src/applet.c
@@ -608,7 +608,7 @@ size_t appctx_htx_snd_buf(struct appctx *appctx, struct buffer *buf, size_t coun
 		goto end;
 	}
 
-	htx_xfer(appctx_htx, buf_htx, count, HTX_XFER_DEFAULT);
+	htx_xfer(appctx_htx, buf_htx, count, HTX_XFER_NO_METADATA);
 	if (htx_is_empty(buf_htx)) {
 		appctx_htx->flags |= (buf_htx->flags & HTX_FL_EOM);
 	}