(trafficserver) branch master updated: Fix crash in HttpSM::tunnel_handler on unhandled VC events (#12959)

[bcall]

This is an automated email from the ASF dual-hosted git repository.

bcall pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/trafficserver.git


The following commit(s) were added to refs/heads/master by this push:
     new 8d5a71f5e8 Fix crash in HttpSM::tunnel_handler on unhandled VC events 
(#12959)
8d5a71f5e8 is described below

commit 8d5a71f5e8a1686ff6edcf53935e10add5f70441
Author: Bryan Call <bc...@apache.org>
AuthorDate: Thu Mar 12 13:00:20 2026 -0700

    Fix crash in HttpSM::tunnel_handler on unhandled VC events (#12959)
    
    tunnel_handler is set as the VC read/write handler for the server
    connection after response header parsing, but it only asserts for
    HTTP_TUNNEL_EVENT_DONE and VC_EVENT_INACTIVITY_TIMEOUT. If a
    VC_EVENT_ACTIVE_TIMEOUT, VC_EVENT_ERROR, or VC_EVENT_EOS arrives
    on the server connection, the assertion fires and aborts the process.
    
    Widen the assertion to accept these events. The handler already sets
    terminate_sm = true for all events, so the behavior is correct — only
    the assertion was too narrow.
    
    Fixes #12958
---
 src/proxy/http/HttpSM.cc | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/src/proxy/http/HttpSM.cc b/src/proxy/http/HttpSM.cc
index b7c46574c8..8b22d69fa3 100644
--- a/src/proxy/http/HttpSM.cc
+++ b/src/proxy/http/HttpSM.cc
@@ -3136,7 +3136,8 @@ HttpSM::tunnel_handler(int event, void * /* data 
ATS_UNUSED */)
     return 0;
   }
 
-  ink_assert(event == HTTP_TUNNEL_EVENT_DONE || event == 
VC_EVENT_INACTIVITY_TIMEOUT);
+  ink_assert(event == HTTP_TUNNEL_EVENT_DONE || event == 
VC_EVENT_INACTIVITY_TIMEOUT || event == VC_EVENT_ACTIVE_TIMEOUT ||
+             event == VC_EVENT_ERROR || event == VC_EVENT_EOS);
   // The tunnel calls this when it is done
   terminate_sm = true;