From: Christopher Faulet <cfaulet@haproxy.com>
Date: Fri, 28 Aug 2026 08:24:08 +0000 (+0200)
Subject: BUG/MEDIUM: mux-spop: Properly handle parsing of split HELLO/DISCONNECT frames
X-Git-Tag: v3.5-dev6~57
X-Git-Url: https://git.kaiwu.me/?a=commitdiff_plain;h=88bb0050de869b50df81ba65606734fa23022abd;p=haproxy.git

BUG/MEDIUM: mux-spop: Properly handle parsing of split HELLO/DISCONNECT frames

The parsing of HELLO/DISCONNECT frames did not properly handle frames split
into several packets. In that case, the frame header parsing was not
bypassed once received and consumed when waiting for the payload. So when
the frame payload was finally received, the demux tried to re-read the frame
headers, triggering this way a parsing error. It was especially an issue on
HELLO frame, because this led to reject the SPOP connexion.

Now, the HELLO/DISCONNECT frames header is only parsed onced. If the demux
must wait for the frame payload, the frame header parsing is skipped to
properly parse the frame payload.

Note it was only an issue for HELLO/DISCONNECT frames.

This patch should fix the issue #3478. It must be backported as far as 3.2.
---

diff --git a/src/mux_spop.c b/src/mux_spop.c
index c8551b7ac..b2cebc19d 100644
--- a/src/mux_spop.c
+++ b/src/mux_spop.c
@@ -2066,7 +2066,7 @@ static void spop_process_demux(struct spop_conn *spop_conn)
 			TRACE_STATE("waiting AGENT HELLO frame to be sent", SPOP_EV_RX_FRAME|SPOP_EV_RX_FHDR|SPOP_EV_RX_HELLO, spop_conn->conn);
 			goto out;
 		}
-		else { /* AGENT_HELLO OR CLOSING */
+		else if (spop_conn->dsi == -1) { /* AGENT_HELLO OR CLOSING */
                        /* ensure that what is pending is a valid AGENT HELLO/DISCONNECT frame. */
 			TRACE_STATE("receiving AGENT HELLO/DISCONNECT frame header", SPOP_EV_RX_FRAME|SPOP_EV_RX_FHDR, spop_conn->conn);
 			if (!spop_get_frame_hdr(&spop_conn->dbuf, &hdr)) {