BUG/MINOR: http-act: restore the response buffer state in the early-hint action
http_action_early_hint() starts with: struct htx *htx = htx_from_buf(&res->buf); htx_from_buf() marks the underlying buffer as full (b_data = b_size) and, as documented, it is the caller's responsibility to call htx_to_buf() to update it back. The function never does it. On the success path this is harmless because the HTX message is not empty, which is exactly what a full buffer represents, and on the error path channel_htx_truncate() takes care of it. But the very first test of the function is: if (!(s->txn.http->req.flags & HTTP_MSGF_VER_11)) goto leave; so for an HTTP/1.0 client, where no 103 response may be emitted, the response buffer is left flagged as containing b_size bytes of data while the HTX message is empty, until some other code path happens to call htx_to_buf() on it. Any code looking at b_data(&res->buf) in between sees a full response buffer. No misbehaviour could be observed (the HTX-aware helpers all work on the HTX message, not on b_data), but leaving the buffer in a state that contradicts its contents is an accident waiting to happen. Let's simply call htx_to_buf() on the leave path. It is a no-op for the other two paths since the message is either non-empty or was already truncated. This should be backported to all supported versions.
W
Willy Tarreau committed
0b329bbe6a0310773a7a8d262c9902fee4705fd1
Parent: 1de5f67
Committed by Christopher Faulet <cfaulet@haproxy.com>
on 7/27/2026, 1:31:10 PM