Error handling for V1F_Setup_Fetch

Fixes #1871

bin/varnishd/cache/cache_backend.c

@@ -247,8 +247,7 @@ vbe_dir_getbody(const struct director *d, struct worker *wrk,
 	CHECK_OBJ_NOTNULL(bo->vfc, VFP_CTX_MAGIC);
 	CHECK_OBJ_NOTNULL(bo->htc, HTTP_CONN_MAGIC);
 
-	V1F_Setup_Fetch(bo->vfc, bo->htc);
-	return (0);
+	return (V1F_Setup_Fetch(bo->vfc, bo->htc));
 }
 
 static const struct suckaddr * __match_proto__(vdi_getip_f)

bin/varnishd/cache/cache_fetch.c

@@ -651,8 +651,14 @@ vbf_stp_fetch(struct worker *wrk, struct busyobj *bo)
 	      http_GetHdr(bo->beresp, H_ETag, &p)))
 		ObjSetFlag(bo->wrk, bo->fetch_objcore, OF_IMSCAND, 1);
 
-	if (bo->htc->body_status != BS_NONE)
-		AZ(VDI_GetBody(bo->wrk, bo));
+	if (bo->htc->body_status != BS_NONE &&
+	    VDI_GetBody(bo->wrk, bo) != 0) {
+		(void)VFP_Error(bo->vfc,
+		    "GetBody failed - backend_workspace overflow?");
+		bo->htc->doclose = SC_OVERLOAD;
+		VDI_Finish(bo->wrk, bo);
+		return (F_STP_ERROR);
+	}
 
 	assert(bo->refcount >= 1);
 

bin/varnishd/cache/cache_req_body.c

@@ -109,7 +109,11 @@ VRB_Iterate(struct req *req, req_body_iter_f *func, void *priv)
 	VFP_Setup(vfc);
 	vfc->http = req->http;
 	vfc->wrk = req->wrk;
-	V1F_Setup_Fetch(vfc, req->htc);
+	if (V1F_Setup_Fetch(vfc, req->htc) != 0) {
+		VSLb(req->vsl, SLT_FetchError, "Fetch Pipeline Setup failed -"
+		    "out of workspace?");
+		return (-1);
+	}
 	if (VFP_Open(vfc) < 0) {
 		VSLb(req->vsl, SLT_FetchError, "Could not open Fetch Pipeline");
 		return (-1);
@@ -239,7 +243,12 @@ VRB_Cache(struct req *req, ssize_t maxsize)
 
 	vfc->http = req->http;
 	vfc->oc = req->body_oc;
-	V1F_Setup_Fetch(vfc, req->htc);
+	if (V1F_Setup_Fetch(vfc, req->htc) != 0) {
+		(void)VFP_Error(vfc, "Fetch Pipeline Setup failed -"
+		    "out of workspace?");
+		req->req_body_status = REQ_BODY_FAIL;
+		return (-1);
+	}
 
 	if (VFP_Open(vfc) < 0) {
 		req->req_body_status = REQ_BODY_FAIL;

bin/varnishd/http1/cache_http1.h

@@ -31,7 +31,7 @@
 int V1F_SendReq(struct worker *, struct busyobj *, uint64_t *ctr,
     int onlycached);
 int V1F_FetchRespHdr(struct busyobj *);
-void V1F_Setup_Fetch(struct vfp_ctx *vfc, struct http_conn *htc);
+int V1F_Setup_Fetch(struct vfp_ctx *vfc, struct http_conn *htc);
 
 /* cache_http1_fsm.c [HTTP1] */
 void HTTP1_Session(struct worker *, struct req *);

bin/varnishd/http1/cache_http1_vfp.c

@@ -260,7 +260,7 @@ static const struct vfp v1f_eof = {
 /*--------------------------------------------------------------------
  */
 
-void
+int
 V1F_Setup_Fetch(struct vfp_ctx *vfc, struct http_conn *htc)
 {
 	struct vfp_entry *vfe;
@@ -272,19 +272,22 @@ V1F_Setup_Fetch(struct vfp_ctx *vfc, struct http_conn *htc)
 	case BS_EOF:
 		assert(htc->content_length == -1);
 		vfe = VFP_Push(vfc, &v1f_eof, 0);
-		XXXAN(vfe);
+		if (vfe == NULL)
+			return (ENOSPC);
 		vfe->priv2 = 0;
 		break;
 	case BS_LENGTH:
 		assert(htc->content_length > 0);
 		vfe = VFP_Push(vfc, &v1f_straight, 0);
-		XXXAN(vfe);
+		if (vfe == NULL)
+			return (ENOSPC);
 		vfe->priv2 = htc->content_length;
 		break;
 	case BS_CHUNKED:
 		assert(htc->content_length == -1);
 		vfe = VFP_Push(vfc, &v1f_chunked, 0);
-		XXXAN(vfe);
+		if (vfe == NULL)
+			return (ENOSPC);
 		vfe->priv2 = -1;
 		break;
 	default:
@@ -292,4 +295,5 @@ V1F_Setup_Fetch(struct vfp_ctx *vfc, struct http_conn *htc)
 		break;
 	}
 	vfe->priv1 = htc;
+	return 0;
 }