FRESH

Hacker News

We found a bug in the hyper HTTP library

145 points by Pop_-

by Twey

3 subcomments

This would have been flagged by Clippy lints `let_underscore_untyped` or `let_underscore_must_use`, which sadly are not enabled by default.

by edelbitter

2 subcomments

Cloudflare does not notice (until a customer complains) that they are sending broken responses at scale? I would have thought they would notice this from sampling and linting a few replies.. just in case they did something like Cloudbleed again.

by worldsavior

1 subcomments

> We spent six weeks chasing a nearly invisible bug — a race condition that occurred only under specific conditions — in the hyper library that impacted how the Images binding returned processed image data back to the client. In the end, it took four lines of code to fix it.
That's a long time, must be frustrating.

by microgpt

5 subcomments

by pseudony

1 subcomments

So “fearless concurrency” still only happens when one just decides to not be afraid… :)

by nopurpose

0 subcomment

Nice writeup, but I don't understand how `curl` didn't trigger bug for them (or any other hyper HTTP server out there), given the explanation in the article.
`curl --http1.1` sends `Connection: Close` so sender (hyper) must attempt to shutdown connection after sending whole body. Surely any network is slower than memory copy into socket kernel buffers, so it must reliably trigger condition "buffer flush can't be done in one go" and thus trigger early TCP shutdown.

0 subcomment

by 100ms

2 subcomments

> The failure was caused by a timing-dependent race condition in hyper’s HTTP/1 connection handling. When the reader was slower and the socket buffer filled, poll_flush returned Poll::Pending, but the dispatch loop discarded that result. Hyper then treated the response as complete and shut down the socket while data remained buffered internally, causing the client to receive an EOF before the full body arrived.
https://github.com/hyperium/hyper/issues/4022
Saved you 3000 words

0 subcomment

by nopurpose

0 subcomment

by logicchains

4 subcomments

by giammbo

1 subcomments

by Thaxll

4 subcomments

by algoth1

1 subcomments

by xacky

0 subcomment