QUIC: segfault in qcc_recv_stop_sending about haproxy

[Tristan971]

Btw I can confirm that the crash is fixed 👍

[Tristan971]

I don't know if it's expected, but I note some application-level data now can show up in backtraces (don't think it was ever the case before); specifically in thread 4 here:

#0  http_parse_authority (parser=0x7f9ac18b55d8, no_userinfo=1) at src/http.c:660
        start = <optimized out>
        ptr = 0x7f9abb0153d7 "adex.org/manga/dc332d04-d3b0-413c-a767-70f5e451b031/feed?includes%5B%5D=scanlation_group&includes%5B%5D=user&limit=500&offset=0&translatedLanguage%5B%5D=en&order%5Bvolume%5D=desc&order%5Bchapter%5D=desc&includeFuturePublishAt=0&includeEmptyPages=0&contentRating%5B%5D=safe&contentRating%5B%5D=suggestive&contentRating%5B%5D=erotica&contentRating%5B%5D=pornographicHTTP/2.0hostapi.mangadex.orgrefererhttps://mangadex.org/extraAndroid/14 Tachiyomi/0.15.2 MangaDex/1.4.190cache-controlno-cacheaccept-encodingbr,gzip"...
        end = 0x7f9abb015543 "HTTP/2.0hostapi.mangadex.orgrefererhttps://mangadex.org/extraAndroid/14 Tachiyomi/0.15.2 MangaDex/1.4.190cache-controlno-cacheaccept-encodingbr,gzipuser-agentTachiyomi Dalvik/2.1.0 (Linux; U; Android 14; SM-G998N Build/UP1A.231005.007)cookie_ga_N0GP6FDRPH=GS1.1.1712610796.48.1.1712610800.56.0.0; _ga=GA1.1.1011480249.1656623776gx-forwarded-for$redactedx-forwarded-hostapi.mangadex.orgx-forwarded-protohttpsforwardedby=EU-WEST-U2x1;for=$redacted;host=api.mangadex.org;proto=httpsvch3=\":443\"; ma=86400md-progr"...
        not_found = <optimized out>
#1  http_parse_path (parser=parser@entry=0x7f9ac18b55d8) at src/http.c:713
        ptr = <optimized out>
        end = <optimized out>
#2  0x000055672c908f9a in smp_fetch_path (args=<optimized out>, smp=0x7f9ac18b5690, kw=0x55672cc1c68c "path", private=<optimized out>) at src/http_fetch.c:1102
        parser = {
          uri = {
            ptr = 0x7f9abb0153cf "api.mangadex.org/manga/dc332d04-d3b0-413c-a767-70f5e451b031/feed?includes%5B%5D=scanlation_group&includes%5B%5D=user&limit=500&offset=0&translatedLanguage%5B%5D=en&order%5Bvolume%5D=desc&order%5Bchapter%5D=desc&includeFuturePublishAt=0&includeEmptyPages=0&contentRating%5B%5D=safe&contentRating%5B%5D=suggestive&contentRating%5B%5D=erotica&contentRating%5B%5D=pornographicHTTP/2.0hostapi.mangadex.orgrefererhttps://mangadex.org/extraAndroid/14 Tachiyomi/0.15.2 MangaDex/1.4.190cache-controlno-cacheaccept-encodin"...,
            len = 372
          },
          state = URI_PARSER_STATE_SCHEME_DONE,
          format = URI_PARSER_FORMAT_ABSURI_OR_AUTHORITY
        }
        chn = <optimized out>
        htx = <optimized out>
        sl = <optimized out>
        path = <optimized out>

Which can include PII/secrets if it prints out sensitive headers like Cookie and XFF/Forwarded in this case.

Not that I personally mind that much (I'll just pay closer attention in the future), but I figure it was not by sheer luck that this never was the case in the past.

[Tristan971]

nb: if it's being a big pain to figure out on your end, let me know, I can probably reasonably get traces in this case as it's really common

[a-denoyelle]

Okay this part as changed recently. The fix should be easy enough here, no need for any traces thanks.

[wtarreau]

Regarding the risk of data in traces, it solely depends on where the code crashes and what gdb will print. Typically if one of the functions in the stack has a pointer argument to such a string or buffer for example and gdb decodes it, it will indeed appear. I think that you should be able to truncate the length of such strings in backtraces using "set print elements 10" (it should limit it to 10 chars). 0 is unlimited.

[Tristan971]

if one of the functions in the stack has a pointer argument to such a string or buffer for example and gdb decodes it, it will indeed appear

I guess so, but I was just surprised as I think it's the first time that happens so clearly in a HAProxy backtrace over the past years and however many backtraces I got :)

So I was (wrongfully) thinking there was some logic preventing it (printing L7 data, that is) at play.

I'll just keep an eye out for it in the future either way, it's fine 👍