BUG/MEDIUM: mux-fcgi: Don't swap trash and dbuf when handling STDERR records
trahs chunks are buffers but not allocated from the buffers pool. And the
"trash" chunk is static and thread-local. It is two reason to not swap it
with a regular buffer allocated from the buffers pool.
Unfortunatly, it is exactly what is performed in the FCGI mux when a STDERR
record is handled. b_xfer() is used to copy data from the demux buffer to
the trash to format the error message. A zeor-copy via a swap may be
performed. In this case, this leads to a memory corruption and a crash
because, some time later, the demux buffer is released because it is
empty. And it is in fact the trash chunk.
b_force_xfer() must be used instead. This function forces the copy.
This patch must be backported as far as 2.2. For 2.4 and 2.2, b_force_xfer()
does not exist. For these versions, the following commit must be backported
too:
* c7860007cc ("MINOR: buf: Add b_force_xfer() function")
(cherry picked from commit 665703d4565181553bb7285929043c94d3490bf7)
Signed-off-by: Christopher Faulet <cfaulet@haproxy.com>
(cherry picked from commit 6be40a4950c85a6605c52a2cece62e842a2d1e82)
Signed-off-by: Christopher Faulet <cfaulet@haproxy.com>
(cherry picked from commit 3574266330c3beb886f626f4c2cc1cdd7a73273e)
Signed-off-by: Christopher Faulet <cfaulet@haproxy.com>
(cherry picked from commit a6e2fc6173f25bcfa3855fbb042527b468be9457)
Signed-off-by: Christopher Faulet <cfaulet@haproxy.com>
diff --git a/src/mux_fcgi.c b/src/mux_fcgi.c
index 5025163..8b3fc31 100644
--- a/src/mux_fcgi.c
+++ b/src/mux_fcgi.c
@@ -2455,7 +2455,7 @@
goto fail; // incomplete record
chunk_reset(&trash);
- ret = b_xfer(&trash, dbuf, MIN(b_room(&trash), fconn->drl));
+ ret = b_force_xfer(&trash, dbuf, MIN(b_room(&trash), fconn->drl));
if (!ret)
goto fail;
fconn->drl -= ret;