BUG/MEDIUM: httpclient/lua: crash because of b_xfer and get_trash_chunk()
authorWilliam Lallemand <wlallemand@haproxy.org>
Thu, 30 Sep 2021 08:07:57 +0000 (10:07 +0200)
committerWilliam Lallemand <wlallemand@haproxy.org>
Wed, 6 Oct 2021 13:15:03 +0000 (15:15 +0200)
commit4d601848871c38cca3182ab2edee932eaf1a531e
treea4238111baaee066489d0be3319b232c7348a2cf
parentf77f1de802ae9617f1f64c7169a9d592ee15b9e1
BUG/MEDIUM: httpclient/lua: crash because of b_xfer and get_trash_chunk()

When using the lua httpclient, haproxy could crash because a b_xfer is
done in httpclient_xfer, which will do a zero-copy swap of the data in
the buffers. The ptr will then be free() by the pool.

However this can't work with a trash buffer, because the area was not
allocated from the pool buffer, so the pool is not suppose to free it
because it does not know this ptr, using -DDEBUG_MEMORY_POOLS will
result with a crash during the free.

Fix the problem by using b_force_xfer() instead of b_xfer which copy
the data instead. The problem still exist with the trash however, and
the trash API must be reworked.
src/http_client.c