(trafficserver) branch master updated: Fix 2 HTTP/2 trailing header memory leaks (#11064)

[bneradt]

This is an automated email from the ASF dual-hosted git repository.

bneradt pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/trafficserver.git


The following commit(s) were added to refs/heads/master by this push:
     new f487c1fad9 Fix 2 HTTP/2 trailing header memory leaks (#11064)
f487c1fad9 is described below

commit f487c1fad9f97dd666dbaa6009deca3aa0c63a77
Author: Brian Neradt <brian.ner...@gmail.com>
AuthorDate: Fri Feb 9 10:34:10 2024 -0600

    Fix 2 HTTP/2 trailing header memory leaks (#11064)
    
    This addresses two leaks discovered while testing gRPC: one in which the
    pre-trailer tunnel has to be deallocated when the trailing tunnel is set
    up, the other in which the header_block memory for the initial headers
    has to be cleaned up when the new trailing headers are being processed.
---
 src/proxy/http/HttpSM.cc                | 1 +
 src/proxy/http2/Http2ConnectionState.cc | 4 ++++
 2 files changed, 5 insertions(+)

diff --git a/src/proxy/http/HttpSM.cc b/src/proxy/http/HttpSM.cc
index 3a196961fc..27039c2d21 100644
--- a/src/proxy/http/HttpSM.cc
+++ b/src/proxy/http/HttpSM.cc
@@ -2829,6 +2829,7 @@ HttpSM::tunnel_handler_trailer(int event, void *data)
   }
   // Signal the _ua.get_txn() to get ready for a trailer
   _ua.get_txn()->set_expect_send_trailer();
+  tunnel.deallocate_buffers();
   tunnel.reset();
   HttpTunnelProducer *p = tunnel.add_producer(server_entry->vc, nbytes, 
buf_start, &HttpSM::tunnel_handler_trailer_server,
                                               HT_HTTP_SERVER, "http server 
trailer");
diff --git a/src/proxy/http2/Http2ConnectionState.cc 
b/src/proxy/http2/Http2ConnectionState.cc
index 0dd8e53d94..232c4db825 100644
--- a/src/proxy/http2/Http2ConnectionState.cc
+++ b/src/proxy/http2/Http2ConnectionState.cc
@@ -414,6 +414,10 @@ Http2ConnectionState::rcv_headers_frame(const Http2Frame 
&frame)
                       "header blocks too large");
   }
 
+  if (stream->trailing_header_is_possible()) {
+    // Don't leak the header_blocks from the initial, non-trailing headers.
+    ats_free(stream->header_blocks);
+  }
   stream->header_blocks = static_cast<uint8_t 
*>(ats_malloc(header_block_fragment_length));
   frame.reader()->memcpy(stream->header_blocks, header_block_fragment_length, 
header_block_fragment_offset);