upstream/haproxy
1
0
Fork 0
mirror of https://github.com/haproxy/haproxy.git synced 2026-06-09 00:32:33 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions 10

BUG/MEDIUM: htx: Fix headers rollback on partial copy in htx_xfer()

Browse source 
In htx_xfer() function, when headers are partially copied, depending on the
flags, a rollback may be performed to remove all copied headers from the
destination message. However, there was an issue in the loop performing the
rollback. Instead of decrementing the returned value using the size of the
HTX block from the destination message, the one from the source message was
used. So the wrong value was be returned and in worst case, it could
overflow.

In addition, the BUG_ON() in the loop was removed because test condition was
wrong.

It is a 3.4-specific issue. No backport needed.
This commit is contained in:
Christopher Faulet 2026-06-01 09:45:32 +02:00
parent de25313cd8
commit 2199053018
1 changed files with 1 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

3
src/htx.c
View file

@ -831,8 +831,7 @@ size_t htx_xfer(struct htx *dst, struct htx *src, size_t count, unsigned int fla
/* Remove partial headers/trailers from <dst> and rollback on <src> to not remove them later */
while (type == HTX_BLK_REQ_SL || type == HTX_BLK_RES_SL || type == HTX_BLK_HDR || type == HTX_BLK_TLR) {
BUG_ON(type != htx_get_blk_type(blk));
ret -= meta_sz + htx_get_blksz(blk);
ret -= meta_sz + htx_get_blksz(dstblk);
htx_remove_blk(dst, dstblk);
dstblk = htx_get_tail_blk(dst);
blk = htx_get_prev_blk(src, blk);