tree c8146551740106add58a1a57d77e02d790aa3a45
parent bb230788c34822b595d3594c037100dfcbe9477c
author Christopher Faulet <cfaulet@haproxy.com> 1672907687 +0100
committer Christopher Faulet <cfaulet@haproxy.com> 1674209512 +0100

BUG/MAJOR: buf: Fix copy of wrapping output data when a buffer is realigned

There is a bug in b_slow_realign() function when wrapping output data are
copied in the swap buffer. block1 and block2 sizes are inverted. Thus blocks
with a wrong size are copied. It leads to data mixin if the first block is
in reality larger than the second one or to a copy of data outside the
buffer is the first block is smaller than the second one.

The bug was introduced when the buffer API was refactored in 1.9. It was
found by a code review and seems never to have been triggered in almost 5
years. However, we cannot exclude it is responsible of some unresolved bugs.

This patch should fix issue #1978. It must be backported as far as 2.0.

(cherry picked from commit 61aded057dafc419f62b9534d03e6c99a3405f7a)
Signed-off-by: Willy Tarreau <w@1wt.eu>
(cherry picked from commit 4a048c13f5ec3bcd060c8af955fe51694400b69d)
Signed-off-by: Christopher Faulet <cfaulet@haproxy.com>
(cherry picked from commit d02e1170f8ef32ec95c123dd90ee74381884da3b)
Signed-off-by: Christopher Faulet <cfaulet@haproxy.com>
(cherry picked from commit 2181c62ee9e7a2d47cf9d9ef87cc33850ad4cb8c)
Signed-off-by: Christopher Faulet <cfaulet@haproxy.com>