> The failure was caused by a timing-dependent race condition in hyper’s HTTP/1 connection handling. When the reader was slower and the socket buffer filled, poll_flush returned Poll::Pending, but the dispatch loop discarded that result. Hyper then treated the response as complete and shut down the socket while data remained buffered internally, causing the client to receive an EOF before the full body arrived. https…
Reminds me of another “slow client”-related bug in gunicorn: https://github.com/benoitc/gunicorn/issues/3334
We found a bug in the hyper HTTP library
21–30 of 97 posts
Re: We found a bug in the hyper HTTP library
#22Earlier quoted context omitted.
Reminds me of another “slow client”-related bug in gunicorn: https://github.com/benoitc/gunicorn/issues/3334
That's not even a bug. That's how TCP works. If you keep sending data to a socket the other side has closed, you get RST.
https://datatracker.ietf.org/doc/html/rfc9112#section-9.6 (this was already in https://datatracker.ietf.org/doc/html/rfc7230#section-6.6)
Re: We found a bug in the hyper HTTP library
#23Cloudflare does not notice (until a customer complains) that they are sending broken responses at scale? I would have thought they would notice this from sampling and linting a few replies.. just in case they did something like Cloudbleed again.
Re: We found a bug in the hyper HTTP library
#24Would using Rust have prevented this?
Did you read the article, or are you a "use rust" parrot / bot based on titles?
Re: We found a bug in the hyper HTTP library
#25Re: We found a bug in the hyper HTTP library
#26Would using Rust have prevented this?
Re: We found a bug in the hyper HTTP library
#27Re: We found a bug in the hyper HTTP library
#28I wonder if this bug was found via project glasswing
Did you read how they said it took weeks? Would run out of tokens at that rate...
Re: We found a bug in the hyper HTTP library
#29So much for Rust forcing you to handle errors.
Why even bother with measures that prevent many problems if they won't prevent all of them, right?
Re: We found a bug in the hyper HTTP library
#30So much for Rust forcing you to handle errors.