tree 5f809312db3f52c921ae8ee21d9383800ece1a20
parent 3c7a79dbb1ecb35717c7a730bec3546aad1c0ede
author Willy Tarreau <w@1wt.eu> 1348751336 +0200
committer Willy Tarreau <w@1wt.eu> 1348751336 +0200

BUG/MAJOR: http: chunk parser was broken with buffer changes

Since at least commit a458b679, msg->sov could become negative in
http_parse_chunk_size() if a chunk size wrapped around the buffer.
The effect is that at some point channel_forward() was called with
a negative size, causing all data to be transferred without being
analyzed anymore.

Since haproxy does not support keep-alive with the server yet, this
issue is not really noticeable, as the server closes the connection
in response. Still, when tunnel mode is used or when pretent-keepalive
is used, it is possible to see the problem.

This issue was reported and diagnosed by William Lallemand at
Exceliance.