tree cddf449f2f025529a6343b596acf1e1c5aab0a78
parent b810554f8f45e4488965b5a2fbfcd2f825fa9d3d
author Willy Tarreau <w@1wt.eu> 1290923844 +0100
committer Willy Tarreau <w@1wt.eu> 1290924383 +0100
encoding latin1

[BUG] http: correctly update the header list when removing two consecutive headers

When a header is removed, the previous header's next pointer is updated
to reflect the next of the current header. However, when cycling through
the loop, we update the prev pointer to point to the deleted header, which
means that if we delete another header, it's the deleted header's next
pointer that will be updated, leaving the deleted header in the list with
a null length, which is forbidden.

We must just not update the prev pointer after a removal.

This bug was present when either "reqdel" and "rspdel" removed two consecutive
headers. It could also occur when removing cookies in either requests or
responses, but since headers were the last header processing, the issue
remained unnoticed.

Issue reported by Hank A. Paulson.

This fix must be ported to 1.4 and possibly 1.3.