From 1e5820fe302abd55f224ee642d3e2a354abeb8ec Mon Sep 17 00:00:00 2001 From: Bryan Call Date: Thu, 12 Mar 2026 09:10:18 -0700 Subject: [PATCH] Fix crash in HttpSM::tunnel_handler on unhandled VC events MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit tunnel_handler is set as the VC read/write handler for the server connection after response header parsing, but it only asserts for HTTP_TUNNEL_EVENT_DONE and VC_EVENT_INACTIVITY_TIMEOUT. If a VC_EVENT_ACTIVE_TIMEOUT, VC_EVENT_ERROR, or VC_EVENT_EOS arrives on the server connection, the assertion fires and aborts the process. Widen the assertion to accept these events. The handler already sets terminate_sm = true for all events, so the behavior is correct — only the assertion was too narrow. Fixes #12958 --- src/proxy/http/HttpSM.cc | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/src/proxy/http/HttpSM.cc b/src/proxy/http/HttpSM.cc index b7c46574c85..8b22d69fa37 100644 --- a/src/proxy/http/HttpSM.cc +++ b/src/proxy/http/HttpSM.cc @@ -3136,7 +3136,8 @@ HttpSM::tunnel_handler(int event, void * /* data ATS_UNUSED */) return 0; } - ink_assert(event == HTTP_TUNNEL_EVENT_DONE || event == VC_EVENT_INACTIVITY_TIMEOUT); + ink_assert(event == HTTP_TUNNEL_EVENT_DONE || event == VC_EVENT_INACTIVITY_TIMEOUT || event == VC_EVENT_ACTIVE_TIMEOUT || + event == VC_EVENT_ERROR || event == VC_EVENT_EOS); // The tunnel calls this when it is done terminate_sm = true;