Christopher Faulet 9e17087aeb BUG/MEDIUM: shctx: Use the next block when data exactly filled a block ...

When the hot list was removed in 3.0, a regression was introduced.
Theorically, it is possible to override data in a block when new data are
appended. It happens when data are copied. If the data size is a multiple of
the block size, all data are copied and the last used block is full. But
instead of saving a reference on the next block as the restart point for the
next copies, we keep a reference on the last full one. On the next read, we
reuse this block and old data are crushed. To hit the bug, no new blocks
should be reserved between the two data copy attempts.

Concretely, for now, it seems not possible to hit the bug. But with a block
size set to 1024, if more than 1024 bytes are reseved, with a first copy of
1024 bytes and a second one with remaining data, data in the first block
will be crushed.

So to fix the bug, the reference of the last block used to write data (which
is in fact the next one to use to perform the next copy) is only updated
when a block is full. In that case the next block is used.

This patch should be backported as far as 3.0 after a period of observation.

2026-02-18 09:44:15 +01:00

..

_ceb_addr.c

…

_ceb_blk.c

…

_ceb_int.c

…

_ceb_str.c

…

acl.c

…

acme.c

…

action.c

…

activity.c

…

applet.c

…

arg.c

…

auth.c

…

backend.c

…

base64.c

…

buf.c

…

cache.c

…

calltrace.c

…

ceb32_tree.c

…

ceb64_tree.c

…

ceba_tree.c

…

cebb_tree.c

…

cebib_tree.c

…

cebis_tree.c

…

cebl_tree.c

…

cebs_tree.c

…

cebtree-dbg.c

…

cebtree-prv.h

…

cfgcond.c

…

cfgdiag.c

…

cfgparse-global.c

…

cfgparse-listen.c

…

cfgparse-peers.c

…

cfgparse-quic.c

…

cfgparse-ssl.c

…

cfgparse-tcp.c

…

cfgparse-unix.c

…

cfgparse.c

…

channel.c

…

check.c

…

chunk.c

…

cli.c

…

clock.c

…

compression.c

…

connection.c

…

counters.c

…

cpu_topo.c

…

cpuset.c

…

debug.c

…

dgram.c

…

dict.c

…

dns_ring.c

…

dns.c

…

dynbuf.c

…

eb32sctree.c

…

eb32tree.c

…

eb64tree.c

…

ebimtree.c

…

ebistree.c

…

ebmbtree.c

…

ebsttree.c

…

ebtree.c

…

ech.c

…

errors.c

…

ev_epoll.c

…

ev_evports.c

…

ev_kqueue.c

…

ev_poll.c

…

ev_select.c

…

event_hdl.c

…

extcheck.c

…

fcgi-app.c

…

fcgi.c

…

fd.c

…

filters.c

…

fix.c

…

flt_bwlim.c

…

flt_http_comp.c

…

flt_spoe.c

…

flt_trace.c

…

freq_ctr.c

…

frontend.c

…

guid.c

…

h1_htx.c

…

h1.c

…

h2.c

…

h3_stats.c

…

h3.c

…

haproxy.c

…

hash.c

…

hlua_fcn.c

…

hlua.c

…

hpack-dec.c

…

hpack-enc.c

…

hpack-huff.c

…

hpack-tbl.c

…

hq_interop.c

…

http_acl.c

…

http_act.c

…

http_ana.c

…

http_client.c

…

http_conv.c

…

http_ext.c

…

http_fetch.c

…

http_htx.c

…

http_rules.c

…

http.c

…

httpclient_cli.c

…

htx.c

…

init.c

…

jwe.c

…

jws.c

…

jwt.c

…

lb_chash.c

…

lb_fas.c

…

lb_fwlc.c

…

lb_fwrr.c

…

lb_map.c

…

lb_ss.c

…

limits.c

…

linuxcap.c

…

listener.c

…

log.c

…

lru.c

…

mailers.c

…

map.c

…

mjson.c

…

mqtt.c

…

mux_fcgi.c

…

mux_h1.c

…

mux_h2.c

…

mux_pt.c

…

mux_quic.c

…

mux_spop.c

…

mworker.c

…

namespace.c

…

ncbmbuf.c

…

ncbuf.c

…

net_helper.c

…

pattern.c

…

payload.c

…

peers.c

…

pipe.c

…

pool.c

…

proto_quic.c

…

proto_rhttp.c

…

proto_sockpair.c

…

proto_tcp.c

…

proto_udp.c

…

proto_uxdg.c

…

proto_uxst.c

…

protocol.c

…

proxy.c

…

qmux_http.c

…

qmux_trace.c

…

qpack-dec.c

…

qpack-enc.c

…

qpack-tbl.c

…

queue.c

…

quic_ack.c

…

quic_cc_bbr.c

…

quic_cc_cubic.c

…

quic_cc_drs.c

…

quic_cc_newreno.c

…

quic_cc_nocc.c

…

quic_cc.c

…

quic_cid.c

…

quic_cli.c

…

quic_conn.c

…

quic_enc.c

…

quic_fctl.c

…

quic_frame.c

…

quic_loss.c

…

quic_openssl_compat.c

…

quic_pacing.c

…

quic_retransmit.c

…

quic_retry.c

…

quic_rules.c

…

quic_rx.c

…

quic_sock.c

…

quic_ssl.c

…

quic_stats.c

…

quic_stream.c

…

quic_tls.c

…

quic_token.c

…

quic_tp.c

…

quic_trace.c

…

quic_tx.c

…

raw_sock.c

…

regex.c

…

resolvers.c

…

ring.c

…

sample.c

…

server_state.c

…

server.c

…

session.c

…

sha1.c

…

shctx.c

…

signal.c

…

sink.c

…

slz.c

…

sock_inet.c

…

sock_unix.c

…

sock.c

…

ssl_ckch.c

…

ssl_clienthello.c

…

ssl_crtlist.c

…

ssl_gencert.c

…

ssl_ocsp.c

…

ssl_sample.c

…

ssl_sock.c

…

ssl_trace.c

…

ssl_utils.c

…

stats-file.c

…

stats-html.c

…

stats-json.c

…

stats-proxy.c

…

stats.c

…

stconn.c

…

stick_table.c

…

stream.c

…

systemd.c

…

task.c

…

tcp_act.c

…

tcp_rules.c

…

tcp_sample.c

…

tcpcheck.c

…

thread.c

…

time.c

…

tools.c

…

trace.c

…

uri_auth.c

…

uri_normalizer.c

…

vars.c

…

version.c

…

wdt.c

…

xprt_handshake.c

…

xprt_quic.c

…