Backport of:

From 68609955873ff845220b7a7cf22147d3617a0b42 Mon Sep 17 00:00:00 2001
From: Christopher Faulet <cfaulet@haproxy.com>
Date: Fri, 9 Oct 2026 15:34:58 +0200
Subject: [PATCH] BUG/MAJOR: h1-htx: report an error on a too long chunk-size
 line

When a chunked message starts with a chunk-size line longer than the input
buffer, the parser was looping forever: the line was never complete, no data
could be consumed, and the connection remained stuck until the client
timeout because the buffer was full and could not be extended.

The full-buffer detection used for too large headers and trailers is now
also applied to the chunk-size line: if nothing was parsed and the input
buffer is full, the line cannot possibly fit and a parsing error is reported
instead of waiting for more data that will never fit.

A workaround consists to reject chunk-encoded request:

    http-request reject if { req.hdr(transfer-encoding) -i chunked }

This should be backported at least to 3.0. But possibly to all stable
versions with some modifications. However, no loop can be experienced on 2.8
and 2.6.

Many thanks to Adam Crawford for the report and the fix.

(cherry picked from commit 6e495dbb2a4850578439cf795966c068c1bdffe3)
[cf: VTC slightly adapted for 2.6]
Signed-off-by: Christopher Faulet <cfaulet@haproxy.com>
---
 .../http-messaging/h1_big_chunk_size_line.vtc      |   65 ++++++++++++++++++++
 src/h1_htx.c                                       |   17 ++++-
 2 files changed, 81 insertions(+), 1 deletion(-)
 create mode 100644 reg-tests/http-messaging/h1_big_chunk_size_line.vtc

--- /dev/null
+++ b/reg-tests/http-messaging/h1_big_chunk_size_line.vtc
@@ -0,0 +1,65 @@
+varnishtest "Test a chunk-size line which fills the whole buffer"
+
+# A chunked request whose first chunk-size line is longer than the
+# buffer used to cause an endless parsing loop: the parser could not
+# progress on the incomplete line, the buffer was full so no more data
+# could be received, and the connection remained stuck until the client
+# timeout. Such a line is now reported as a parsing error.
+#
+# The first client below sends a request whose first chunk-size line,
+# including its final LF, is longer than tune.bufsize, so it cannot
+# possibly fit in any buffer. The proxy must reply with a 400 at once
+# instead of remaining stuck until the client timeout. The error is
+# checked in the log because the response may be lost when the proxy
+# closes the connection with the request not fully drained.
+#
+# The second client sends a valid request to check that the proxy
+# remains alive and behaves normally.
+
+feature ignore_unknown_macro
+
+syslog S -level info {
+    recv
+    expect ~ ".* li1 li1/s1 [0-9]*/[0-9]*/-1/-1/[0-9]* 400 .* PH-- .* \"POST /big HTTP/1.1\""
+} -start
+
+haproxy h1 -conf {
+    global
+    .if feature(THREAD)
+        thread-groups 1
+    .endif
+        tune.bufsize 1024
+
+    defaults
+        mode http
+        timeout connect "${HAPROXY_TEST_TIMEOUT-5s}"
+        timeout client  "${HAPROXY_TEST_TIMEOUT-5s}"
+        timeout server  "${HAPROXY_TEST_TIMEOUT-5s}"
+
+    listen li1
+        bind "fd@${li1}"
+        option httplog
+        option dontlog-normal
+        log "${S_addr}:${S_port}" local0 info
+        server s1 "${h1_li2_addr}:${h1_li2_port}"
+
+    listen li2
+        bind "fd@${li2}"
+        http-request return status 200
+} -start
+
+# 42 + 984 + 2 = 1028 bytes: too long for a 1024-byte buffer
+client c1 -connect ${h1_li1_sock} {
+    txreq -req POST -url /big -hdr "Transfer-Encoding: chunked" -nolen
+    send_n 984 "0"
+    send "\r\n"
+} -run
+
+# a valid request must still work
+client c2 -connect ${h1_li1_sock} {
+    txreq -url /ok
+    rxresp
+    expect resp.status == 200
+} -run
+
+syslog S -wait
--- a/src/h1_htx.c
+++ b/src/h1_htx.c
@@ -505,8 +505,21 @@ int h1_parse_msg_data(struct h1m *h1m, s
 			uint64_t chksz;
 
 			ret = h1_parse_chunk_size(srcbuf, ofs, b_data(srcbuf), &chksz);
-			if (ret <= 0)
+			if (ret <= 0) {
+				/* Incomplete chunk-size line. If the input buffer only
+				 * contains it and is full, which is detected by it being full
+				 * and the offset to be zero, it's an error because the line is
+				 * too large to be handled by the parser. Report a parsing
+				 * error rather than retrying forever on the same data.
+				 */
+				if (!ret && !ofs && !buf_room_for_htx_data(srcbuf)) {
+					(*dsthtx)->flags |= HTX_FL_PARSING_ERROR;
+					h1m->err_state = h1m->state;
+					h1m->err_pos = ofs;
+					return 0;
+				}
 				goto end;
+			}
 			h1m->state = ((!chksz) ? H1_MSG_TRAILERS : H1_MSG_DATA);
 			h1m->curr_len  = chksz;
 			h1m->body_len += chksz;