mirror/haproxy
1
0
Fork 0
mirror of http://git.haproxy.org/git/haproxy.git synced 2026-02-03 23:13:44 +02:00
Code Issues Packages Projects Releases Wiki Activity

BUG/MEDIUM: mux-h1: Skip UNUSED htx block when formating the start line

Browse Source 
UNUSED blocks were not properly handled when the H1 multiplexer was
formatting the start line of a request or a response. UNUSED was ignored but
not removed from HTX message. So the mux can loop infinitly on such block.

It could be seen a a major issue but in fact it happens only if a very
specific case on the reponse processing (at least I think so): the server
must send an interim message (a 100-continue for intance) with the final
response. HAProxy must receive both in same time and the final reponse must
be intercepted (via a http-response return action for instance), In that
case, the interim message is fowarded and the server final reponse is
removed and replaced by a proxy error message.

Now UNUSED htx blocks are properly skipped and removed.

This patch must be backported as far as 3.0.
This commit is contained in:
Christopher Faulet
2026-01-23 10:05:08 +01:00
parent be68ecc37d
commit a3e9a04435
1 changed files with 6 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
src/mux_h1.c
View File

@@ -2488,8 +2488,10 @@ static size_t h1_make_reqline(struct h1s *h1s, struct h1m *h1m, struct htx *htx,
goto end;
type = htx_get_blk_type(blk);
sz = htx_get_blksz(blk);
if (type == HTX_BLK_UNUSED)
if (type == HTX_BLK_UNUSED) {
htx_remove_blk(htx, blk);
continue;
}
if (type != HTX_BLK_REQ_SL || sz > count)
goto error;
break;
@@ -2577,8 +2579,10 @@ static size_t h1_make_stline(struct h1s *h1s, struct h1m *h1m, struct htx *htx,
type = htx_get_blk_type(blk);
sz = htx_get_blksz(blk);
if (type == HTX_BLK_UNUSED)
if (type == HTX_BLK_UNUSED) {
htx_remove_blk(htx, blk);
continue;
}
if (type != HTX_BLK_RES_SL || sz > count)
goto error;
break;