(trafficserver) branch 10.1.x updated: Fix crash in HttpSM::tunnel_handler on unhandled VC events (#12959)

[cmcfarlen]

This is an automated email from the ASF dual-hosted git repository.

cmcfarlen pushed a commit to branch 10.1.x
in repository https://gitbox.apache.org/repos/asf/trafficserver.git


The following commit(s) were added to refs/heads/10.1.x by this push:
     new 3a3e05052b Fix crash in HttpSM::tunnel_handler on unhandled VC events 
(#12959)
3a3e05052b is described below

commit 3a3e05052b3794dc810ba7ee8568286267518c21
Author: Bryan Call <bc...@apache.org>
AuthorDate: Thu Mar 12 13:00:20 2026 -0700

    Fix crash in HttpSM::tunnel_handler on unhandled VC events (#12959)
    
    tunnel_handler is set as the VC read/write handler for the server
    connection after response header parsing, but it only asserts for
    HTTP_TUNNEL_EVENT_DONE and VC_EVENT_INACTIVITY_TIMEOUT. If a
    VC_EVENT_ACTIVE_TIMEOUT, VC_EVENT_ERROR, or VC_EVENT_EOS arrives
    on the server connection, the assertion fires and aborts the process.
    
    Widen the assertion to accept these events. The handler already sets
    terminate_sm = true for all events, so the behavior is correct — only
    the assertion was too narrow.
    
    Fixes #12958
    
    (cherry picked from commit 8d5a71f5e8a1686ff6edcf53935e10add5f70441)
---
 src/proxy/http/HttpSM.cc | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/src/proxy/http/HttpSM.cc b/src/proxy/http/HttpSM.cc
index 067cdc45d0..ac2e1b657c 100644
--- a/src/proxy/http/HttpSM.cc
+++ b/src/proxy/http/HttpSM.cc
@@ -3050,7 +3050,8 @@ HttpSM::tunnel_handler(int event, void * /* data 
ATS_UNUSED */)
     return 0;
   }
 
-  ink_assert(event == HTTP_TUNNEL_EVENT_DONE || event == 
VC_EVENT_INACTIVITY_TIMEOUT);
+  ink_assert(event == HTTP_TUNNEL_EVENT_DONE || event == 
VC_EVENT_INACTIVITY_TIMEOUT || event == VC_EVENT_ACTIVE_TIMEOUT ||
+             event == VC_EVENT_ERROR || event == VC_EVENT_EOS);
   // The tunnel calls this when it is done
   terminate_sm = true;