net/haproxy/patches/0015-BUG-MAJOR-http-Fix-possible-infinity-loop-in-http_sy.patch

   1 From af9b52e92be8ca6a07f9156dcb0b08dd2ad8db75 Mon Sep 17 00:00:00 2001
   2 From: Christopher Faulet <cfaulet@haproxy.com>
   3 Date: Thu, 20 Jul 2017 11:05:10 +0200
   4 Subject: [PATCH 15/18] BUG/MAJOR: http: Fix possible infinity loop in
   5  http_sync_(req|res)_state
   6
   7 In commit "MINOR: http: Switch requests/responses in TUNNEL mode only by
   8 checking txn flags", it is possible to have an infinite loop on HTTP_MSG_CLOSING
   9 state.
  10
  11 (cherry picked from commit 56d260916f61e48c8b2f1fd2f9431afac776d160)
  12 Signed-off-by: William Lallemand <wlallemand@haproxy.org>
  13 ---
  14  src/proto_http.c | 4 ++--
  15  1 file changed, 2 insertions(+), 2 deletions(-)
  16
  17 diff --git a/src/proto_http.c b/src/proto_http.c
  18 index e776e4d5..4a030013 100644
  19 --- a/src/proto_http.c
  20 +++ b/src/proto_http.c
  21 @@ -5394,8 +5394,8 @@ int http_sync_req_state(struct stream *s)
  22                 else if (chn->flags & CF_SHUTW) {
  23                         txn->req.err_state = txn->req.msg_state;
  24                         txn->req.msg_state = HTTP_MSG_ERROR;
  25 -                       goto wait_other_side;
  26                 }
  27 +               goto wait_other_side;
  28         }
  29
  30         if (txn->req.msg_state == HTTP_MSG_CLOSED) {
  31 @@ -5523,8 +5523,8 @@ int http_sync_res_state(struct stream *s)
  32                         s->be->be_counters.cli_aborts++;
  33                         if (objt_server(s->target))
  34                                 objt_server(s->target)->counters.cli_aborts++;
  35 -                       goto wait_other_side;
  36                 }
  37 +               goto wait_other_side;
  38         }
  39
  40         if (txn->rsp.msg_state == HTTP_MSG_CLOSED) {
  41 --
  42 2.13.0
  43