tree bd19df21fe1359478ad46e4442a256a4941ac300
parent 703bed58b0393495c60a185f25fa40825b3f00f0
author Christopher Faulet <cfaulet@haproxy.com> 1561491662 +0200
committer Christopher Faulet <cfaulet@haproxy.com> 1561537132 +0200

BUG/MAJOR: mux-h1: Don't crush trash chunk area when outgoing message is formatted

When an outgoing HTX message is formatted before sending it, a trash chunk is
used to do the formatting. Its content is then copied into the output buffer of
the H1 connection. There are some tricks to avoid this last copy. First, if
possible we perform a zero-copy by swapping the area of the HTX buffer with the
one of the output buffer. If zero-copy is not possible, but if the output buffer
is empty, we don't use a trash chunk. To do so, we change the area of the trash
chunk to point on the one of the output buffer. But it is terribly wrong. Trash
chunks are global variables, allocated statically. If the area is changed, the
old one is lost. Worst, the area of the output buffer is dynamically allocated,
so it is released when emptied, leaving the trash chunk with a freed area (in
fact, it is a bit more complicated because buffers are allocated from a memory
pool).

So, honestly, I don't know why we never experienced any problem because this bug
till now. To fix it, we still use a temporary buffer, but we assign it to a
trash chunk only when other solutions were excluded. This way, we never
overwrite the area of a trash chunk.

This patch must be backported to 2.0 and 1.9.

(cherry picked from commit c2518a53aed70b373edc5c169cc3a02ed2398bba)
Signed-off-by: Christopher Faulet <cfaulet@haproxy.com>