RepoMirrors/haproxy
1
0
Fork 0
mirror of http://git.haproxy.org/git/haproxy.git/ synced 2025-01-11 16:29:36 +00:00
Code Issues Packages Projects Releases Wiki Activity

BUG/MEDIUM: mux-h1: Don't loop on the headers parsing if the read0 was received

Browse Source 
If a server sends part of headers and then close its connection, the mux H1
reamins blocked in an infinite loop trying to read more data to finish the
parsing of the message. The flag CS_FL_REOS is set on the conn_stream. But
because there are some data in the input buffer, CS_FL_EOS is never set.

To fix the bug, in h1_process_input, when CS_FL_REOS is set on the conn_stream,
we also set CS_FL_EOS if the input buffer is empty OR if the channel's buffer is
empty.
This commit is contained in:
Christopher Faulet 2018-12-10 15:30:06 +01:00 committed by Willy Tarreau
parent cb55f485da
commit f6ce9d61f9
1 changed files with 6 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
src/mux_h1.c
View File

@ -1304,11 +1304,14 @@ static size_t h1_process_input(struct h1c *h1c, struct buffer *buf, int flags)
else {
h1_release_buf(h1c, &h1c->ibuf);
h1_sync_messages(h1c);
h1s->cs->flags &= ~(CS_FL_RCV_MORE | CS_FL_WANT_ROOM);
if (h1s->cs->flags & CS_FL_REOS)
h1s->cs->flags |= CS_FL_EOS;
}
if ((h1s->cs->flags & CS_FL_REOS) && (!b_data(&h1c->ibuf) || htx_is_empty(htx))) {
h1s->cs->flags |= CS_FL_EOS;
h1s->cs->flags &= ~(CS_FL_RCV_MORE | CS_FL_WANT_ROOM);
}
return total;
parsing_err: