Fix for missing error handling of gunzip'ing fetched objects

for ESI processing. Adapted from phk's fix for #1184.

bin/varnishd/cache_esi_fetch.c

@@ -117,9 +117,12 @@ vfp_esi_bytes_gu(struct sess *sp, struct http_conn *htc, ssize_t bytes)
 		if (VGZ_ObufStorage(sp, vg))
 			return(-1);
 		i = VGZ_Gunzip(vg, &dp, &dl);
-		xxxassert(i == VGZ_OK || i == VGZ_END);
-		VEP_parse(sp, dp, dl);
-		sp->obj->len += dl;
+		if (i < VGZ_OK)
+			return (-1);
+		if (dl > 0) {
+			VEP_parse(sp, dp, dl);
+			sp->obj->len += dl;
+		}
 	}
 	return (1);
 }
@@ -270,8 +273,8 @@ vfp_esi_bytes_gg(struct sess *sp, struct http_conn *htc, size_t bytes)
 		do {
 			VGZ_Obuf(sp->wrk->vgz_rx, ibuf2, sizeof ibuf2);
 			i = VGZ_Gunzip(sp->wrk->vgz_rx, &dp, &dl);
-			/* XXX: check i */
-			assert(i >= VGZ_OK);
+			if (i < VGZ_OK)
+				return (-1);
 			vef->bufp = ibuf2;
 			if (dl > 0)
 				VEP_parse(sp, ibuf2, dl);

bin/varnishtest/tests/r01184.vtc

+varnishtest "Corrupt gzip'ed ESI objects"
+
+# First, check that our data is actually good
+
+server s1 {
+       rxreq
+       expect req.url == "/"
+       txresp -nolen \
+               -hdr "Content-Encoding: gzip" \
+               -hdr "Transfer-Encoding: Chunked"
+       send "ed\r\n"
+                sendhex " 1f 8b 08 00 c2 39 33 50  02 03 45 90 4d 6a 03 31"
+                sendhex " 0c 85 f7 73 8a 47 2e 10  d9 f2 9f ca 34 d0 c2 64"
+                sendhex " 5b 08 bd 80 2d cb 10 28  5d 34 f4 fe f5 30 d0 68"
+                sendhex " 25 89 a7 f7 3e b4 be 6f  d7 8f db 76 59 e8 28 d8"
+                sendhex " 10 45 f3 a9 83 b8 18 1c  7b c2 30 55 04 17 13 c4"
+                sendhex " 0f 07 5f 7a 38 f4 8e 50  b3 37 d4 3a 32 4a 34 07"
+                sendhex " 8a 9c d1 92 77 48 d4 0a  72 ea 06 5f b3 1c fa dd"
+                sendhex " 2b b9 88 20 99 e6 9a 3c  84 7c 85 8e 50 e0 59 2a"
+                sendhex " 42 b0 8a 34 0f 96 d5 1e  f7 97 fb b7 7e fd 4e 87"
+                sendhex " c7 8f be 9e ce fb 74 3a  3f 51 89 a3 9b 7e b2 43"
+                sendhex " a4 86 a2 55 90 b9 29 4c  4b 83 b8 99 5f b5 bb 27"
+                sendhex " 6a d4 86 18 22 83 8a 26  f4 11 1a 5c eb 34 3b ca"
+                sendhex " 20 31 9e 12 29 ff a8 92  78 a2 e6 ec 61 55 12 fc"
+                sendhex " 68 84 6c 12 41 b9 cf 2f  30 3b f0 10 5e d6 b7 eb"
+                sendhex " e7 76 bb 2c 7f 8c 90 4a  14 4c 01 00 00"
+       send "\r\n"
+       chunkedlen 0
+       rxreq
+       expect req.url == "/incl"
+       txresp -body "INCLUDED\n"
+} -start
+
+varnish v1 -vcl+backend {
+       sub vcl_fetch {
+               set beresp.do_esi = true;
+       }
+} -start
+
+client c1 {
+       txreq -url "/"
+       rxresp
+       expect resp.status == 200
+       expect resp.bodylen == 315
+} -run
+
+# Second, corrupt them, while using the g-g path
+
+server s1 {
+       rxreq
+       expect req.url == "/c"
+       txresp -nolen \
+               -hdr "Content-Encoding: gzip" \
+               -hdr "Transfer-Encoding: Chunked"
+       send "ed\r\n"
+                sendhex " 1f 8b 08 00 c2 39 33 50  02 03 45 90 4d 6a 03 31"
+                sendhex " 0c 85 f7 73 8a 47 2e 10  d9 f2 9f ca 34 d0 c2 64"
+                sendhex " 5b 08 bd 80 2d cb 10 28  5d 34 f4 fe f5 30 d0 68"
+                sendhex " 25 89 a7 f7 3e b4 be 6f  d7 8f db 76 59 e8 28 d8"
+                sendhex " 10 45 f3 a9 83 b8 18 1c  7b c2 30 55 04 17 13 c4"
+                sendhex " 0f 07 5f 7a 38 f4 8e 50  b3 37 d4 3a 32 4a 34 07"
+                sendhex " FF FF FF FF FF FF FF FF  72 ea 06 5f b3 1c fa dd"
+		expect_close
+
+#                sendhex " 2b b9 88 20 99 e6 9a 3c  84 7c 85 8e 50 e0 59 2a"
+#                sendhex " 42 b0 8a 34 0f 96 d5 1e  f7 97 fb b7 7e fd 4e 87"
+#                sendhex " c7 8f be 9e ce fb 74 3a  3f 51 89 a3 9b 7e b2 43"
+#                sendhex " a4 86 a2 55 90 b9 29 4c  4b 83 b8 99 5f b5 bb 27"
+#                sendhex " 6a d4 86 18 22 83 8a 26  f4 11 1a 5c eb 34 3b ca"
+#                sendhex " 20 31 9e 12 29 ff a8 92  78 a2 e6 ec 61 55 12 fc"
+#                sendhex " 68 84 6c 12 41 b9 cf 2f  30 3b f0 10 5e d6 b7 eb"
+#                sendhex " e7 76 bb 2c 7f 8c 90 4a  14 4c 01 00 00"
+#       send "\r\n"
+#       chunkedlen 0
+} -start
+
+varnish v1 -vcl+backend {
+       sub vcl_fetch {
+               set beresp.do_esi = true;
+       }
+}
+
+client c1 {
+       txreq -url "/c"
+       rxresp
+       expect resp.status == 503
+} -run
+
+# Third, corrupt them, while using the g-u path
+
+server s1 {
+       rxreq
+       expect req.url == "/d"
+       txresp -nolen \
+               -hdr "Content-Encoding: gzip" \
+               -hdr "Transfer-Encoding: Chunked"
+       send "ed\r\n"
+                sendhex " 1f 8b 08 00 c2 39 33 50  02 03 45 90 4d 6a 03 31"
+                sendhex " 0c 85 f7 73 8a 47 2e 10  d9 f2 9f ca 34 d0 c2 64"
+                sendhex " 5b 08 bd 80 2d cb 10 28  5d 34 f4 fe f5 30 d0 68"
+                sendhex " 25 89 a7 f7 3e b4 be 6f  d7 8f db 76 59 e8 28 d8"
+                sendhex " 10 45 f3 a9 83 b8 18 1c  7b c2 30 55 04 17 13 c4"
+                sendhex " 0f 07 5f 7a 38 f4 8e 50  b3 37 d4 3a 32 4a 34 07"
+                sendhex " FF FF FF FF FF FF FF FF  72 ea 06 5f b3 1c fa dd"
+		expect_close
+
+#                sendhex " 2b b9 88 20 99 e6 9a 3c  84 7c 85 8e 50 e0 59 2a"
+#                sendhex " 42 b0 8a 34 0f 96 d5 1e  f7 97 fb b7 7e fd 4e 87"
+#                sendhex " c7 8f be 9e ce fb 74 3a  3f 51 89 a3 9b 7e b2 43"
+#                sendhex " a4 86 a2 55 90 b9 29 4c  4b 83 b8 99 5f b5 bb 27"
+#                sendhex " 6a d4 86 18 22 83 8a 26  f4 11 1a 5c eb 34 3b ca"
+#                sendhex " 20 31 9e 12 29 ff a8 92  78 a2 e6 ec 61 55 12 fc"
+#                sendhex " 68 84 6c 12 41 b9 cf 2f  30 3b f0 10 5e d6 b7 eb"
+#                sendhex " e7 76 bb 2c 7f 8c 90 4a  14 4c 01 00 00"
+#       send "\r\n"
+#       chunkedlen 0
+} -start
+
+varnish v1 -vcl+backend {
+       sub vcl_fetch {
+               set beresp.do_esi = true;
+               set beresp.do_gunzip = true;
+       }
+}
+
+client c1 {
+       txreq -url "/d"
+       rxresp
+       expect resp.status == 503
+} -run