From: Christopher Faulet <cfaulet@haproxy.com>
Date: Fri, 18 Dec 2020 14:13:47 +0000 (+0100)
Subject: BUG/MEDIUM: mux-h1: Handle h1_process() failures on a pipelined request
X-Git-Tag: v2.3.3~29
X-Git-Url: http://git.haproxy.org/?a=commitdiff_plain;h=43b1cfa62aebbd8623297c423f5c9ab6901fba8e;p=haproxy-2.3.git

BUG/MEDIUM: mux-h1: Handle h1_process() failures on a pipelined request

On frontend side, when a conn-stream is detached from a H1 connection, the
H1 stream is destroyed and if we already have some data to parse (a
pipelined request), we process these data immedialtely calling
h1_process(). Then we adjust the H1 connection timeout. But h1_process() may
fail and release the H1 connection. For instance, a parsing error may be
reported. Thus, when that happens, we must not use anymore the H1 connection
and exit.

This patch must be backported as far as the 2.2. This bug can impact the 2.3
and the 2.2, in theory, if h1 stream creation fails. But, concretly, it only
fails on the 2.4 because the requests are now parsed at this step.

(cherry picked from commit 0c366a87619206d1bf1c9f69698933d0e58b7be5)
Signed-off-by: Christopher Faulet <cfaulet@haproxy.com>
---

diff --git a/src/mux_h1.c b/src/mux_h1.c
index c6c15c2..80af533 100644
--- a/src/mux_h1.c
+++ b/src/mux_h1.c
@@ -2543,8 +2543,10 @@ static void h1_detach(struct conn_stream *cs)
 	}
 	else {
 		/* If we have a new request, process it immediately */
-		if (unlikely(b_data(&h1c->ibuf)))
-			h1_process(h1c);
+		if (unlikely(b_data(&h1c->ibuf))) {
+			if (h1_process(h1c) == -1)
+				goto end;
+		}
 		else
 			h1c->conn->xprt->subscribe(h1c->conn, h1c->conn->xprt_ctx, SUB_RETRY_RECV, &h1c->wait_event);
 		h1_refresh_timeout(h1c);