The appctx_htx_snd_buf() fast path uses b_xfer() when the destination
HTX message is empty and the source contains a complete HTX message.
However, it does not verify that both buffers have the same capacity.
When tune.bufsize.large is configured and wait-for-body uses
use-large-buffer, the channel buffer may be larger than the applet
input buffer. The fast path can then attempt to transfer more data
than the destination can hold, triggering a fatal bounds check and
terminating the worker process.
Only use the fast path when the source and destination buffers have
the same capacity. Otherwise, use the existing HTX block-wise transfer
path.
---
src/applet.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/src/applet.c b/src/applet.c
index 59969fc1c..94494d17c 100644
--- a/src/applet.c
+++ b/src/applet.c
@@ -599,7 +599,8 @@ size_t appctx_htx_snd_buf(struct appctx *appctx, struct
buffer *buf, size_t coun
size_t ret = 0;
ret = buf_htx->data;
- if (htx_is_empty_noerr(appctx_htx) && buf_htx->data == count) {
+ if (htx_is_empty_noerr(appctx_htx) && buf_htx->data == count &&
+ b_size(&appctx->inbuf) == b_size(buf)) {
htx_to_buf(appctx_htx, &appctx->inbuf);
htx_to_buf(buf_htx, buf);
b_xfer(&appctx->inbuf, buf, b_data(buf));
--
2.55.0
