From: Christopher Faulet <cfaulet@haproxy.com>
Date: Wed, 7 Oct 2026 14:04:50 +0000 (+0200)
Subject: BUG/MINOR: h1: forget a previous pass' results when parsing headers only
X-Git-Tag: v3.5-dev10~138
X-Git-Url: https://git.kaiwu.me/$%7BISSUES%7D/static/gitweb.js?a=commitdiff_plain;h=2bef554cc1b26091b80ce66bbcaa87c638bead25;p=haproxy.git

BUG/MINOR: h1: forget a previous pass' results when parsing headers only

In H1_MF_HDRS_ONLY mode, which is used for FCGI responses (no start-line),
h1_headers_to_hdr_list() always parses the headers again from the beginning
when it's called again after an incomplete parsing. But unlike the normal
restart path, the flags and lengths found during the previous pass were not
reset. So when the headers of an FCGI response are received in several
parts, the content-length found in the first part is seen as a duplicate
during the second pass and the header is dropped. The response is then
forwarded to the client without content-length, close-delimited, and the
client connection is closed. Similarly, "transfer-encoding: chunked" is seen
twice and reported as an error (ignored in this mode).

Let's reset the flags as on a regular restart, keeping the version and
method flags set by the caller in this mode, as well as the lengths.

This patch should be backported to all supported versions.
---

diff --git a/src/h1.c b/src/h1.c
index 12c70d0b1..2cef677ac 100644
--- a/src/h1.c
+++ b/src/h1.c
@@ -448,7 +448,8 @@ int h1_headers_to_hdr_list(char *start, const char *stop,
 
 	if (h1m->flags & H1_MF_HDRS_ONLY) {
 		state = H1_MSG_HDR_FIRST;
-		h1m->next = 0;
+		h1m->flags &= (H1_MF_RESTART_MASK|H1_MF_VER_11);
+		h1m->curr_len = h1m->body_len = h1m->next = 0;
 	}
 	else {
 		state = h1m->state;