From: Adam Crawford <adamcrawford253@gmail.com>
Date: Mon, 26 Oct 2026 04:21:40 +0000 (-0500)
Subject: BUG/MEDIUM: applet: check buffer sizes before HTX transfer
X-Git-Tag: v3.5-dev10~28
X-Git-Url: https://git.kaiwu.me/?a=commitdiff_plain;h=b820db493779afe2bceaa28918d9d0b94744e746;p=haproxy.git

BUG/MEDIUM: applet: check buffer sizes before HTX transfer

The appctx_htx_snd_buf() fast path uses b_xfer() when the destination
HTX message is empty and the source contains a complete HTX message.
However, it does not verify that both buffers have the same capacity.

When tune.bufsize.large is configured and wait-for-body uses
use-large-buffer, the channel buffer may be larger than the applet
input buffer. The fast path can then attempt to transfer more data
than the destination can hold, triggering a fatal bounds check and
terminating the worker process.

Only use the fast path when the source and destination buffers have
the same capacity. Otherwise, use the existing HTX block-wise transfer
path.

[cf: Must be backported to 3.4]
---

diff --git a/src/applet.c b/src/applet.c
index 59969fc1c..94494d17c 100644
--- a/src/applet.c
+++ b/src/applet.c
@@ -599,7 +599,8 @@ size_t appctx_htx_snd_buf(struct appctx *appctx, struct buffer *buf, size_t coun
 	size_t ret = 0;
 
 	ret = buf_htx->data;
-	if (htx_is_empty_noerr(appctx_htx) && buf_htx->data == count) {
+	if (htx_is_empty_noerr(appctx_htx) && buf_htx->data == count &&
+		b_size(&appctx->inbuf) == b_size(buf)) {
 		htx_to_buf(appctx_htx, &appctx->inbuf);
 		htx_to_buf(buf_htx, buf);
 		b_xfer(&appctx->inbuf, buf, b_data(buf));