Le 26/10/2026 à 5:21 AM, Adam Crawford a écrit :
The appctx_htx_snd_buf() fast path uses b_xfer() when the destination HTX message is empty and the source contains a complete HTX message. However, it does not verify that both buffers have the same capacity.When tune.bufsize.large is configured and wait-for-body uses use-large-buffer, the channel buffer may be larger than the applet input buffer. The fast path can then attempt to transfer more data than the destination can hold, triggering a fatal bounds check and terminating the worker process. Only use the fast path when the source and destination buffers have the same capacity. Otherwise, use the existing HTX block-wise transfer path. --- src/applet.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/src/applet.c b/src/applet.c index 59969fc1c..94494d17c 100644 --- a/src/applet.c +++ b/src/applet.c @@ -599,7 +599,8 @@ size_t appctx_htx_snd_buf(struct appctx *appctx, struct buffer *buf, size_t coun size_t ret = 0;ret = buf_htx->data;- if (htx_is_empty_noerr(appctx_htx) && buf_htx->data == count) { + if (htx_is_empty_noerr(appctx_htx) && buf_htx->data == count && + b_size(&appctx->inbuf) == b_size(buf)) { htx_to_buf(appctx_htx, &appctx->inbuf); htx_to_buf(buf_htx, buf); b_xfer(&appctx->inbuf, buf, b_data(buf));
Thanks, now merged. -- Christopher Faulet
