tree 2521a5547203d0efacedf6474de64b40d01ec50c
parent beba1b8cda7f3048a94c04ce803623bb6d9e2a29
author Christopher Faulet <cfaulet@haproxy.com> 1694451459 +0200
committer Christopher Faulet <cfaulet@haproxy.com> 1696422716 +0200

BUG/MEDIUM: mux-fcgi: Don't swap trash and dbuf when handling STDERR records

trahs chunks are buffers but not allocated from the buffers pool. And the
"trash" chunk is static and thread-local. It is two reason to not swap it
with a regular buffer allocated from the buffers pool.

Unfortunatly, it is exactly what is performed in the FCGI mux when a STDERR
record is handled. b_xfer() is used to copy data from the demux buffer to
the trash to format the error message. A zeor-copy via a swap may be
performed. In this case, this leads to a memory corruption and a crash
because, some time later, the demux buffer is released because it is
empty. And it is in fact the trash chunk.

b_force_xfer() must be used instead. This function forces the copy.

This patch must be backported as far as 2.2. For 2.4 and 2.2, b_force_xfer()
does not exist. For these versions, the following commit must be backported
too:

  * c7860007cc ("MINOR: buf: Add b_force_xfer() function")

(cherry picked from commit 665703d4565181553bb7285929043c94d3490bf7)
Signed-off-by: Christopher Faulet <cfaulet@haproxy.com>
(cherry picked from commit 6be40a4950c85a6605c52a2cece62e842a2d1e82)
Signed-off-by: Christopher Faulet <cfaulet@haproxy.com>
(cherry picked from commit 3574266330c3beb886f626f4c2cc1cdd7a73273e)
Signed-off-by: Christopher Faulet <cfaulet@haproxy.com>
(cherry picked from commit a6e2fc6173f25bcfa3855fbb042527b468be9457)
Signed-off-by: Christopher Faulet <cfaulet@haproxy.com>