BUG/MINOR: http-htx: check the trash allocation in http_scheme_based_normalize()

http_scheme_based_normalize() uses a trash chunk to rebuild the target URI when
the default port must be dropped or when an empty path must be replaced by "/",
but it does not test the allocation:

	struct buffer *temp = alloc_trash_chunk();
	struct ist meth, vsn;

	/* meth */
	chunk_memcat(temp, HTX_SL_REQ_MPTR(sl), HTX_SL_REQ_MLEN(sl));

alloc_trash_chunk() takes its memory from pool_head_trash and returns NULL when
the pool is exhausted, in which case chunk_memcat() dereferences NULL and the
worker crashes. All the other users of alloc_trash_chunk() in the HTTP code
(http_act.c, http_ana.c) do test the result.

Normalization is performed on every absolute-form request URI (from H1, H2 and
H3), so this is reachable under memory pressure. Let's simply report a failure,
which the callers already handle as a rewrite error.

This was introduced by commit 4c0882b1b ("MEDIUM: http: implement scheme-based
normalization") in 2.5-dev2, so it should be backported to all supported
versions.

diff --git a/src/http_htx.c b/src/http_htx.c
index 422fbe83c9642bbfff7fb0f9ff57211c93bf3ab7..2bae91c4a8bde1cd4dda9452b24aea4613f13f66 100644 (file)
--- a/src/http_htx.c
+++ b/src/http_htx.c
@@ -1880,6 +1880,9 @@ int http_scheme_based_normalize(struct htx *htx)
                struct buffer *temp = alloc_trash_chunk();
                struct ist meth, vsn;
 
+               if (!temp)
+                       goto fail;
+
                /* meth */
                chunk_memcat(temp, HTX_SL_REQ_MPTR(sl), HTX_SL_REQ_MLEN(sl));
                meth = ist2(temp->area, HTX_SL_REQ_MLEN(sl));