tree 93d6e50d998e442919662b3a128ad21fa23ba990
parent 81189f6bcae66bb8d76f5fe16d11ce23121385fb
author Christopher Faulet <cfaulet@haproxy.com> 1646058596 +0100
committer Christopher Faulet <cfaulet@haproxy.com> 1646130946 +0100

BUG/MEDIUM: htx: Fix a possible null derefs in htx_xfer_blks()

In htx_xfer_blks() function, when headers or trailers are partially
transferred, we rollback the copy by removing copied blocks. Internally, all
blocks between <dstref> and <dstblk> are removed. But if the transfer was
stopped because we failed to reserve a block, the variable <dstblk> is
NULL. Thus, we must not try to remove it. It is unexpected to call
htx_remove_blk() in this case.

htx_remove_blk() was updated to test <blk> variable inside the existing
BUG_ON(). The block must be defined.

For now, this bug may only be encountered when H2 trailers are copied. On H2
headers, the destination buffer is empty. Thus a swap is performed.

This patch should fix the issue #1578. It must be backported as far as 2.4.

(cherry picked from commit 234a10aa9bce34781b5b0b4c4ffb595e7563eb41)
Signed-off-by: Christopher Faulet <cfaulet@haproxy.com>
(cherry picked from commit 14a874996379de6d9b72a24bc5f96382e9417dd3)
Signed-off-by: Christopher Faulet <cfaulet@haproxy.com>