From bbfa7938bd74adbfa435f26503fc10f5938195a3 Mon Sep 17 00:00:00 2001 From: Willy Tarreau Date: Mon, 25 Jan 2010 01:49:57 +0100 Subject: [PATCH] [BUG] buffer_replace2 must never change the ->w entry This function is used to move data which is located between ->w and ->r, so it must not touch ->w, otherwise it will displace pending data which is before the one we're actually overwriting. The issue arises with some pipelined responses which cause some part of the previous one to be chopped off when removing the connection: close header, thus corrupting last response and shifting next one. Those are detected in the logs because the next response will be a 502 with flags PH. --- src/buffers.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/src/buffers.c b/src/buffers.c index 4f1450739..9aa8c3d11 100644 --- a/src/buffers.c +++ b/src/buffers.c @@ -178,7 +178,7 @@ int buffer_si_peekline(struct buffer *buf, char *str, int len) /* * this function writes the string at position which must be in buffer , * and moves just after the end of . - * 's parameters (l, r, w, h, lr) are recomputed to be valid after the shift. + * 's parameters (l, r, lr) are recomputed to be valid after the shift. * the shift value (positive or negative) is returned. * If there's no space left, the move is not done. * The function does not adjust ->send_max nor BF_OUT_EMPTY because it does not @@ -196,6 +196,9 @@ int buffer_replace(struct buffer *b, char *pos, char *end, const char *str) if (delta + b->r >= b->data + b->size) return 0; /* no space left */ + if (delta + b->r > b->w && b->w >= b->r && b->l) + return 0; /* no space left before wrapping data */ + /* first, protect the end of the buffer */ memmove(end + delta, end, b->r - end); @@ -204,7 +207,6 @@ int buffer_replace(struct buffer *b, char *pos, char *end, const char *str) /* we only move data after the displaced zone */ if (b->r > pos) b->r += delta; - if (b->w > pos) b->w += delta; if (b->lr > pos) b->lr += delta; b->l += delta; @@ -230,6 +232,9 @@ int buffer_replace2(struct buffer *b, char *pos, char *end, const char *str, int if (delta + b->r >= b->data + b->size) return 0; /* no space left */ + if (delta + b->r > b->w && b->w >= b->r && b->l) + return 0; /* no space left before wrapping data */ + /* first, protect the end of the buffer */ memmove(end + delta, end, b->r - end); @@ -239,7 +244,6 @@ int buffer_replace2(struct buffer *b, char *pos, char *end, const char *str, int /* we only move data after the displaced zone */ if (b->r > pos) b->r += delta; - if (b->w > pos) b->w += delta; if (b->lr > pos) b->lr += delta; b->l += delta;