Skip to content

Commit b38e248

Browse files
wtarreauwtarreau
committed
MINOR: htx: don't reserve a block when there is no free space left
htx_reserve_max_data() computed the available room up front but tested the empty-message case before testing that room: int32_t len = htx_free_data_space(htx); if (htx->head == -1) goto rsv_new_block; if (!len) return (struct htx_ret){.ret = 0, .blk = NULL}; So a message which is both empty and has no room at all went to rsv_new_block with len == 0. That matters because htx_reserve_nxblk() only rejects a reservation when "blksz > htx_free_data_space(htx)", so a zero-sized one passes even when the free space is zero, and the "Empty message" path then evaluates htx_get_blk(htx, 0), that is htx->blocks + (htx->size - sizeof(struct htx_blk)). For any size below sizeof(struct htx_blk) this subtraction underflows the uint32_t and yields a pointer roughly 4 GB away, which is immediately written to. The case that is trivial to reach in theory is the shared empty HTX (htx_empty, size 0) that htxbuf() and htx_from_buf() return for an unallocated buffer. No caller can do it today: the only caller, h1_parse_full_contig_chunks(), returns earlier when the maximum is not larger than sizeof(struct htx_blk), and the H1 mux allocates the destination buffer before parsing into it. So this is not a fix for a reachable bug, just one less trap for whoever adds the next caller. Swapping the two tests is transparent for every other case: when the message is empty but its buffer is allocated, the free space is necessarily non-zero, so the early return cannot trigger and we still reach rsv_new_block as before.
1 parent 1c8625e commit b38e248

1 file changed

Lines changed: 3 additions & 3 deletions

File tree

‎src/htx.c‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1024,12 +1024,12 @@ struct htx_ret htx_reserve_max_data(struct htx *htx)
10241024
int32_t len = htx_free_data_space(htx);
10251025
uint32_t flags = 0;
10261026

1027-
if (htx->head == -1)
1028-
goto rsv_new_block;
1029-
10301027
if (!len)
10311028
return (struct htx_ret){.ret = 0, .blk = NULL};
10321029

1030+
if (htx->head == -1)
1031+
goto rsv_new_block;
1032+
10331033
/* get the tail and head block */
10341034
tailblk = htx_get_tail_blk(htx);
10351035
if (tailblk == NULL)

0 commit comments

Comments
 (0)