evbuffer_prepend breaks with empty buffers

[htuch]

It looks like evbuffer_prepend doesn't check for empty, whereas evbuffer_prepend_buffer does this explicitly. This breaks in the example at envoyproxy/envoy#6062. Basically, an empty prepend to an immutable chain entry, followed by a evbuffer_remove_buffer and then evbuffer_add does the wrong thing.

We work around this in Envoy in envoyproxy/envoy#6042 by skipping prepend of empty, I think we could do the same in libevent. However, it would be great to get some expert eyes on this, since there may be a more interesting underlying bug that this is tickling.

[azat]

Hi! Nice catch and thanks for the reproducer!

Sure this is a bug, but not sure that simply check for length is enough here (looks odd at first glance since this is not just prepend-over-append there is some kind of corruption and I can confirm this even without adding evbuffer_prepend(buf, "", 0)).

Have you looked deeply or should take care of this?

[htuch]

@azat I haven't done more than a cursory look, I probably won't have too many cycles for this in the next couple of weeks, so might be best for folks in the libevent community to take this.

[htuch]

@azat FWIW, just filed #778, there is definitely some corruption that goes deeper than the empty prepend. We have other fuzz bugs that we've hit around libevent, I'm going to postpone diving into them until we have solution to these two bugs, since they may be dupes.

[azat]

Initial issue should be fixed by fdfabbe (I moved you reproducer into our unit tests)
And i decided (c4fbae3) to add a check against datlen == 0 (to make it similar against other places)

Thank you for the reproducer!

[htuch]

@azat I can confirm that bumping to c4fbae3 fixes both issues. Thanks!