Skip to content

bug: body stream leak in compression methods when response is discarded #2244

Description

@pageton

Description

In compress.go, brotli.go, and zstd.go, when a response has a body stream and the caller requests compression, the original body stream is wrapped in a NewStreamReader. The compression methods (brotliBody, gzipBody, deflateBody, zstdBody in http.go:1886-2072) only handle io.Closer/ReadCloserWithError on the wrapper, but if the response is discarded before reading, the inner stream is never closed.

// http.go:1886 (brotliBody example)
bs := resp.bodyStream
resp.bodyStream = NewStreamReader(func(w *bufio.Writer) {
    // bs is used inside callback, but if callback is never called...
    br := acquireBrotliReader(bs)
    // ...
})

This is particularly problematic for file-based body streams (e.g., from SendFile).

Impact

  • File handle leaks when compressed responses are discarded without reading
  • Connection leaks for network-based body streams

Suggested Fix

Ensure Response.Reset() and closeBodyStream() properly cascade Close to inner streams even when the outer stream wrapper was never read.

File

http.go:1886-1901, http.go:1944-1959, http.go:2002-2017, http.go:2057-2072

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions