tree 18ebaa48e8512e4807a4c116ae7fce87788d090c
parent c6827d52c1dd5552398749e6ad5e06c8c6265ae3
author Christopher Faulet <cfaulet@haproxy.com> 1551089708 +0100
committer Christopher Faulet <cfaulet@haproxy.com> 1551186263 +0100

BUG/MAJOR: cache/htx: Set the start-line offset when a cached object is served

When the function htx_add_stline() is used, this offset is automatically set
when necessary. But the HTX cache applet adds all header blocks of the responses
manually, including the start-line. So its offset must be explicitly set by the
applet.

When everything goes well, the HTTP analyzer http_wait_for_response() looks for
the start-line in the HTX messages, calling http_find_stline(). If necessary,
the start-line offet will also be automatically set during this stage. So the
bug of the HTX cache applet does not hurt most of the time. But, when an error
occurred, HTTP responses analyzers can be bypassed. In such caese, the
start-line offset of cached responses remains unset.

Some part of the code relies on the start-line offset to process the HTX
messages. Among others, when H2 responses are sent to clients, the H2
multiplexer read the start-line without any check, because it _MUST_ always be
there. if its offset is not set, a NULL pointer is dereferenced leading to a
segfault.

The patch must be backported to 1.9.