(trafficserver) 02/13: Fix crash in HttpSM::tunnel_handler on unhandled VC events (#12959)

[cm...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

cmcfarlen pushed a commit to branch 10.2.x
in repository https://gitbox.apache.org/repos/asf/trafficserver.git

commit f434038ffa89bcb429112eb1224ce98c59148758
Author: Bryan Call <bc...@apache.org>
AuthorDate: Thu Mar 12 13:00:20 2026 -0700

    Fix crash in HttpSM::tunnel_handler on unhandled VC events (#12959)
    
    tunnel_handler is set as the VC read/write handler for the server
    connection after response header parsing, but it only asserts for
    HTTP_TUNNEL_EVENT_DONE and VC_EVENT_INACTIVITY_TIMEOUT. If a
    VC_EVENT_ACTIVE_TIMEOUT, VC_EVENT_ERROR, or VC_EVENT_EOS arrives
    on the server connection, the assertion fires and aborts the process.
    
    Widen the assertion to accept these events. The handler already sets
    terminate_sm = true for all events, so the behavior is correct — only
    the assertion was too narrow.
    
    Fixes #12958
    
    (cherry picked from commit 8d5a71f5e8a1686ff6edcf53935e10add5f70441)
---
 src/proxy/http/HttpSM.cc | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/src/proxy/http/HttpSM.cc b/src/proxy/http/HttpSM.cc
index 683b9ae96d..51da56f44b 100644
--- a/src/proxy/http/HttpSM.cc
+++ b/src/proxy/http/HttpSM.cc
@@ -3112,7 +3112,8 @@ HttpSM::tunnel_handler(int event, void * /* data ATS_UNUSED */)
     return 0;
   }
 
-  ink_assert(event == HTTP_TUNNEL_EVENT_DONE || event == VC_EVENT_INACTIVITY_TIMEOUT);
+  ink_assert(event == HTTP_TUNNEL_EVENT_DONE || event == VC_EVENT_INACTIVITY_TIMEOUT || event == VC_EVENT_ACTIVE_TIMEOUT ||
+             event == VC_EVENT_ERROR || event == VC_EVENT_EOS);
   // The tunnel calls this when it is done
   terminate_sm = true;