cloudflare/pingora · error

body buf is initialized before reading trailers

Error message

body buf is initialized before reading trailers

What it means

Internal invariant panic in pingora's HTTP/1.1 body reader. After entering the ChunkedFinal state to parse the trailer section of a chunked message, the code re-borrows self.body_buf with as_deref().expect(): the reader's state machine guarantees the buffer exists whenever the trailer loop runs. Hitting this panic means pingora's internal state tracking became inconsistent, not that your application logic passed bad input.

Source

Thrown at pingora-core/src/protocols/http/v1/body.rs:849

                        .await
                        .or_err(ReadError, "when reading trailers end")?
                };
                if n == 0 {
                    self.body_state = PS::Done(read);
                    return Error::e_explain(
                        ConnectionClosed,
                        format!(
                            "Connection prematurely closed without the termination chunk, \
                            read {read} bytes, {trailers_read} trailer bytes"
                        ),
                    );
                }

                // Re-borrow just the buffer field so `self.body_state` stays assignable below.
                let buf = &self
                    .body_buf
                    .as_deref()
                    .expect("body buf is initialized before reading trailers")[..n];

                let mut start = 0;
                // try to find end within the current IO buffer
                while start < n {
                    // Adjusts body state through each iteration to add trailers read
                    // Each iteration finds the next CR or LF to advance the buf
                    let (trailers_read, end_read) = match self.body_state {
                        PS::ChunkedFinal(_, new_trailers_read, _, new_end_read) => {
                            (new_trailers_read, new_end_read)
                        }
                        _ => unreachable!(),
                    };

                    let mut buf = &buf[start..n];
                    trace!(
                        "Parsing chunk end for buf {:?}",
                        String::from_utf8_lossy(buf).escape_default(),
                    );

View on GitHub (pinned to 0046038bd4)

Solutions

1. Pin/upgrade to a pingora release where the trailer state machine is known-good and check the changelog for fixes touching pingora-core/src/protocols/http/v1/body.rs
2. Capture the failing stream (tcpdump) to get the exact chunked+trailer byte sequence for a minimal reproduction
3. Report the reproduction to the pingora issue tracker — this expect is an internal invariant, not input validation
4. If it fires under your own filter code, audit anything that touches the session body reader or swallows body-read errors before trailers are parsed

// Panics in per-connection tasks are contained by tokio: observe them via the task handle
let handle = tokio::spawn(async move { /* connection / test driving pingora */ });
if let Err(join_err) = handle.await {
    if join_err.is_panic() {
        // log with RUST_BACKTRACE=1 context; the connection died, the service lives on
        tracing::error!("connection task panicked: {join_err}");
    }
}

When it happens

Trigger: Reading trailers of a chunked HTTP/1.1 request/response (state ChunkedFinal) when body_buf was left None/empty before the loop re-borrows it. Typically surfaced by fuzzers feeding mutated chunked bodies with trailer sections split across reads, or by a pingora version with a regression in the BodyReader state machine (e.g. buffer taken/consumed on an error path before trailer parsing re-runs).

Common situations: Fuzzing pingora with trailer-bearing chunked encodings; upgrading between pingora versions that changed body.rs state handling; custom ProxyHttp/HTTP filters that call body-reading APIs in unusual orders or recover from partial body reads and resume reading trailers.

Related errors

• body buf exists once a chunk was parsed out of it
• body buf exists once a partial chunk head was buffered
• must have read body buf
• non-pathname unix sockets not supported as peer
• Tried to listen with no addr specified

AI-assisted analysis of cloudflare/pingora@0046038bd4 (2026-08-16). Data as JSON: /api/errors/fe66e8b79100ae58. Report an issue: GitHub.