BUG/MINOR: h3: fix crash with maxrewrite on response headers

This patch is similar to the previous one. This time it enforces HTTP
headers maxrewrite setting on responses parsing from the server to the
client. Thus, this change is related to the backend side handling.

As a side effect, it also prevents a BUG_ON() crash on
qcs_http_rcv_buf(). Indeed, maxrewrite is also used by the stream layer
to reduce the destination buffer. Thus, htx_xfer() may be interrupted
due to a lack of space after setting HTX_FL_PARSING_ERROR flag. This
triggers the BUG_ON() in qcs_http_rcv_buf(). This does not happen on
frontend side with requests as HTX buffer is passed to the newly created
stream instance without rcv_buf invocation.

This should be backported up to 3.3.

diff --git a/src/h3.c b/src/h3.c
index ed6463374f7518804668d1d6facfb9371e38824a..a64ad4bd4149b7b30276d9b10b06e659be13d4da 100644 (file)
--- a/src/h3.c
+++ b/src/h3.c
@@ -1467,6 +1467,13 @@ static ssize_t h3_resp_headers_to_htx(struct qcs *qcs, const struct buffer *buf,
        if (fin)
                htx_set_eom(htx);
 
+       /* Check that at least reserved space remains after headers decoding. */
+       if (htx_free_space(htx) < global.tune.maxrewrite) {
+               /* TODO should be a stream level error instead of a connection one. */
+               len = -1;
+               goto out;
+       }
+
        /* Detect if an interim or final response was handled. */
        if (sl->info.res.status >= 100 && sl->info.res.status < 200) {
                TRACE_USER("receiving interim response", H3_EV_RX_FRAME|H3_EV_RX_HDR, qcs->qcc->conn, qcs);