RepoMirrors/haproxy
1
0
Fork 0
mirror of http://git.haproxy.org/git/haproxy.git/ synced 2025-04-21 14:35:45 +00:00
Code Issues Packages Projects Releases Wiki Activity

BUG/MAJOR: mux_h2: Don't consume more payload than received for skipped frames

Browse Source 
When a frame is received for a unknown or already closed stream, it must be
skipped. This also happens when a stream error is reported. But we must be sure
to only skip received data. In the loop in h2_process_demux(), when such frames
are handled, all the frame lenght is systematically skipped. If the frame
payload is partially received, it leaves the demux buffer in an undefined
state. Because of this bug, all sort of errors may be observed, like crash or
intermittent freeze.

This patch must be backported to 2.0, 1.9 and 1.8.
This commit is contained in:
Christopher Faulet 2019-09-26 16:38:28 +02:00
parent ea7a7781a9
commit 5112a603d9
1 changed files with 9 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
src/mux_h2.c
View File

@ -3103,10 +3103,15 @@ static void h2_process_demux(struct h2c *h2c)
}
if (h2c->st0 != H2_CS_FRAME_H) {
b_del(&h2c->dbuf, h2c->dfl);
h2c->dsi = -1;
TRACE_STATE("switching to FRAME_H", H2_EV_RX_FRAME|H2_EV_RX_FHDR, h2c->conn);
h2c->st0 = H2_CS_FRAME_H;
TRACE_DEVEL("stream error, skip frame payload", H2_EV_RX_FRAME, h2c->conn, h2s);
ret = MIN(b_data(&h2c->dbuf), h2c->dfl);
b_del(&h2c->dbuf, ret);
h2c->dfl -= ret;
if (!h2c->dfl) {
TRACE_STATE("switching to FRAME_H", H2_EV_RX_FRAME|H2_EV_RX_FHDR, h2c->conn);
h2c->st0 = H2_CS_FRAME_H;
h2c->dsi = -1;
}
}
}