From: Martin Mirchev <mirchevmartin2203@gmail.com>
Date: Fri, 30 Oct 2026 05:49:13 +0000 (+0800)
Subject: BUG/MINOR: httpclient/lua: raise an error on too many request headers
X-Git-Tag: v3.5-dev11~48
X-Git-Url: https://git.kaiwu.me/%7B@url%7D?a=commitdiff_plain;h=a2175623a4bb0e050b100c105fe84435dc473211;p=haproxy.git

BUG/MINOR: httpclient/lua: raise an error on too many request headers

When a Lua httpclient request has more header values than
tune.http.maxhdr, hlua_httpclient_table_to_hdrs() pops the inner
lua_next() key and value and returns NULL. But the key and value of the
outer lua_next() loop on the headers table stay on the stack, so the
caller's lua_next() on the argument table gets the wrong key and the
request fails with a confusing error:

    runtime error: invalid key to 'next' from [C]: in method 'get'

The header values already duplicated with istdup() are also leaked.

Let's free them and raise an explicit Lua error instead, as the caller
does for the other invalid arguments:

    runtime error: too many headers (tune.http.maxhdr is 101)

The function is now marked __LJMP and its call wrapped in MAY_LJMP().

This should be backported where 2db801c63 ("BUG/MINOR: hlua: fix stack
overflow in httpclient headers conversion") was backported. Before 3.5
the function is in src/hlua.c.
---

diff --git a/src/http_client.c b/src/http_client.c
index c5b1a0a73..c9d2ee0a0 100644
--- a/src/http_client.c
+++ b/src/http_client.c
@@ -1689,7 +1689,7 @@ __LJMP static int hlua_httpclient_get_headers(lua_State *L, struct hlua_httpclie
  *
  * Caller must free the result
  */
-static struct http_hdr *hlua_httpclient_table_to_hdrs(lua_State *L)
+__LJMP static struct http_hdr *hlua_httpclient_table_to_hdrs(lua_State *L)
 {
 	struct http_hdr hdrs[global.tune.max_http_hdr];
 	struct http_hdr *result = NULL;
@@ -1718,8 +1718,12 @@ static struct http_hdr *hlua_httpclient_table_to_hdrs(lua_State *L)
 			}
 
 			if (hdr_num >= global.tune.max_http_hdr) {
-				lua_pop(L, 2);
-				goto skip_headers;
+				while (hdr_num--) {
+					istfree(&hdrs[hdr_num].n);
+					istfree(&hdrs[hdr_num].v);
+				}
+				WILL_LJMP(luaL_error(L, "too many headers (tune.http.maxhdr is %d)",
+				                     global.tune.max_http_hdr));
 			}
 
 			v = lua_tolstring(L, -1, &vlen);
@@ -1914,7 +1918,7 @@ __LJMP static int hlua_httpclient_send(lua_State *L, enum http_meth_t meth)
 		} else if (strcmp(lua_tostring(L, -2), "headers") == 0) {
 			if (lua_type(L, -1) != LUA_TTABLE)
 				WILL_LJMP(luaL_error(L, "invalid parameter in 'headers', must be a table"));
-			hdrs = hlua_httpclient_table_to_hdrs(L);
+			hdrs = MAY_LJMP(hlua_httpclient_table_to_hdrs(L));
 
 		} else if (strcmp(lua_tostring(L, -2), "body") == 0) {
 			if (lua_type(L, -1) != LUA_TSTRING)