Add error handling for STV_NewObject() in vrb_pull

Fixes: #2831

bin/varnishd/cache/cache_req_body.c

@@ -73,7 +73,14 @@ vrb_pull(struct req *req, ssize_t maxsize, objiterate_f *func, void *priv)
 
 	req->storage = NULL;
 
-	XXXAN(STV_NewObject(req->wrk, req->body_oc, stv, 8));
+	if (STV_NewObject(req->wrk, req->body_oc, stv, 8) == 0) {
+		req->req_body_status = REQ_BODY_FAIL;
+		HSH_DerefBoc(req->wrk, req->body_oc);
+		AZ(HSH_DerefObjCore(req->wrk, &req->body_oc, 0));
+		(void)VFP_Error(vfc, "Object allocation failed:"
+		    " Ran out of space in %s", stv->vclname);
+		return (-1);
+	}
 
 	vfc->oc = req->body_oc;
 

bin/varnishtest/tests/r02831.vtc

+varnishtest "#2831: Out of storage in cache_req_body"
+
+server s1 {
+	rxreq
+	expect req.url == "/obj1"
+	txresp -bodylen 1048400
+} -start
+
+varnish v1 \
+	-arg "-p nuke_limit=0" \
+	-arg "-sTransient=default,1m" \
+	-syntax 4.0 \
+	-vcl+backend {
+	import std;
+	sub vcl_recv {
+		if (req.method == "POST") {
+			std.cache_req_body(1KB);
+		}
+	}
+	sub vcl_backend_response {
+		set beresp.do_stream = false;
+		set beresp.storage = storage.Transient;
+		# Unset Date header to not change the object sizes
+		unset beresp.http.Date;
+	}
+} -start
+
+varnish v1 -cliok "param.set debug +syncvsl"
+
+delay .1
+
+client c1 {
+	# Fill transient
+	txreq -url "/obj1"
+	rxresp
+	expect resp.status == 200
+} -run
+
+delay .1
+
+varnish v1 -expect SM?.Transient.g_bytes > 1048400
+varnish v1 -expect SM?.Transient.g_space < 100
+
+client c1 {
+	# No space for caching this req.body
+	txreq -req "POST" -body "foobar"
+	delay 1
+} -run
+
+varnish v1 -expect SMA.Transient.c_fail == 1
+
+client c1 {
+	# Check that Varnish is still alive
+	txreq -url "/obj1"
+	rxresp
+	expect resp.status == 200
+} -run