From: Christopher Faulet <cfaulet@haproxy.com>
Date: Wed, 26 Aug 2026 08:32:59 +0000 (+0200)
Subject: BUG/MINOR: flt-http-comp: Don't read next block to detect end of data
X-Git-Tag: v3.5-dev6~69
X-Git-Url: https://git.kaiwu.me/?a=commitdiff_plain;h=a1107f8de73365ba8f6fc9819d0ec3e02c5d1117;p=haproxy.git

BUG/MINOR: flt-http-comp: Don't read next block to detect end of data

During the compression, on a DATA block, the next blocks was tested to know
if the end of data was reached. However, it is not valid to do so because a
prior filter may have limited the data forwarding to the current block to
inject more DATA blocks later for instance. Because of this bug, we could
detect the end of the payload too early, hijacking this way processing of
prior filters.

This test was added as an optimization, to save a loop on the HTX
message. So it can be safely removed.

For now, it is not possible to hit the bug with in-house filters. But a lua
filter modifiying the payload could trigger it. And it will be an issue if
the compression filter is chained with the decompression one (once
added). So let's fix it now.

This patch must be backported to all supported versions.
---

diff --git a/src/flt_http_comp.c b/src/flt_http_comp.c
index 7f2567feb..ea328dd91 100644
--- a/src/flt_http_comp.c
+++ b/src/flt_http_comp.c
@@ -295,11 +295,10 @@ comp_http_payload(struct stream *s, struct filter *filter, struct http_msg *msg,
 			msg->chn->flags |= CF_WAKE_WRITE;
 			goto end;
 		}
-
 		switch (type) {
 			case HTX_BLK_DATA:
 				/* it is the last data block */
-				last = ((!next && (htx->flags & HTX_FL_EOM)) || (next && htx_get_blk_type(next) != HTX_BLK_DATA));
+				last = (!next && (htx->flags & HTX_FL_EOM));
 				v = htx_get_blk_value(htx, blk);
 				v = istadv(v, offset);
 				if (v.len > len) {