Wt

a better stack trace:

(gdb) info stack 10
#0  0x00007ffff6ce0085 in http::server::RequestParser::consumeChar(char*)
    (this=0x7fffd0004598, d=0x7fffc800b0fc "Accept-Encoding\r\nX-From: sfp-web-3\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Encoding: gzip,deflate\r\nHost: www.oneunified.net\r\nUser-Agent: Mozilla/5.0 (Windows N"...) at /home/rpb/data/projects/libs-build/wt/src/http/RequestParser.C:120
#1  0x00007ffff6ce5861 in http::server::RequestParser::consume(http::server::Request&, char*)
    (this=0x7fffd0004598, req=..., it=0x7fffc800b0fc "Accept-Encoding\r\nX-From: sfp-web-3\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Encoding: gzip,deflate\r\nHost: www.oneunified.net\r\nUser-Agent: Mozilla/5.0 (Windows N"...) at /home/rpb/data/projects/libs-build/wt/src/http/RequestParser.C:1089
#2  0x00007ffff6ce01cd in http::server::RequestParser::parse(http::server::Request&, char*, char*)
    (this=0x7fffd0004598, req=..., begin=0x7fffc800b0fd "ccept-Encoding\r\nX-From: sfp-web-3\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Encoding: gzip,deflate\r\nHost: www.oneunified.net\r\nUser-Agent: Mozilla/5.0 (Windows NT"..., end=0x7fffc800b2ac "") at /home/rpb/data/projects/libs-build/wt/src/http/RequestParser.C:161
#3  0x00007ffff6c95181 in http::server::Connection::handleReadRequest0() (this=0x7fffd0004380) at /home/rpb/data/projects/libs-build/wt/src/http/Connection.C:192
#4  0x00007ffff6c95ad7 in http::server::Connection::handleReadRequest(boost::system::error_code const&, unsigned long) (this=0x7fffd0004380, e=..., bytes_transferred=668) at /home/rpb/data/projects/libs-build/wt/src/http/Connection.C:264
#5  0x00007ffff6d4ea65 in std::__invoke_impl<void, void (http::server::Connection::*&)(boost::system::error_code const&, unsigned long), std::shared_ptr<http::server::TcpConnection>&, boost::system::error_code const&, unsigned long const&>(std::__invoke_memfun_deref, void (http::server::Connection::*&)(boost::system::error_code const&, unsigned long), std::shared_ptr<http::server::TcpConnection>&, boost::system::error_code const&, unsigned long const&) (__f=
    @0x7ffff0fb1040: (void (http::server::Connection::*)(http::server::Connection * const, const boost::system::error_code &, unsigned long)) 0x7ffff6c95a64 <http::server::Connection::handleReadRequest(boost::system::error_code const&, unsigned long)>, __t=std::shared_ptr<http::server::TcpConnection> (use count 4, weak count 1) = {...}) at /usr/include/c++/9/bits/invoke.h:73
#6  0x00007ffff6d4e99f in std::__invoke<void (http::server::Connection::*&)(boost::system::error_code const&, unsigned long), std::shared_ptr<http::server::TcpConnection>&, boost::system::error_code const&, unsigned long const&>(void (http::server::Connection::*&)(boost::system::error_code const&, unsigned long), std::shared_ptr<http::server::TcpConnection>&, boost::system::error_code const&, unsigned long const&) (__fn=
    @0x7ffff0fb1040: (void (http::server::Connection::*)(http::server::Connection * const, const boost::system::error_code &, unsigned long)) 0x7ffff6c95a64 <http::server::Connection::handleReadRequest(boost::system::error_code const&, unsigned long)>) at /usr/include/c++/9/bits/invoke.h:95
#7  0x00007ffff6d4e8e0 in std::_Bind<void (http::server::Connection::*(std::shared_ptr<http::server::TcpConnection>, std::_Placeholder<1>, std::_Placeholder<2>))(boost::system::error_code const&, unsigned long)>::__call<void, boost::system::error_code const&, unsigned long const&, 0ul, 1ul, 2ul>(std::tuple<boost::system::error_code const&, unsigned long const&>&&, std::_Index_tuple<0ul, 1ul, 2ul>) (this=0x7ffff0fb1040, __args=...) at /usr/include/c++/9/functional:400
#8  0x00007ffff6d4e838 in std::_Bind<void (http::server::Connection::*(std::shared_ptr<http::server::TcpConnection>, std::_Placeholder<1>, std::_Placeholder<2>))(boost::system::error_code const&, unsigned long)>::operator()<boost::system::error_code const&, unsigned long const&, void>(boost::system::error_code const&, unsigned long const&) (this=0x7ffff0fb1040) at /usr/include/c++/9/functional:484
#9  0x00007ffff6d4e7a1 in boost::asio::detail::binder2<std::_Bind<void (http::server::Connection::*(std::shared_ptr<http::server::TcpConnection>, std::_Placeholder<1>, std::_Placeholder<2>))(boost::system::error_code const&, unsigned long)>, boost::system::error_code, unsigned long>::operator()() (this=0x7ffff0fb1040) at /usr/local/include/boost-1_69/boost/asio/detail/bind_handler.hpp:164

Source is from git master around Jan 11.

Seems currentString_ hasn't been initialized:

(gdb) p d
$1 = 0x7fffc800b0fc "Accept-Encoding\r\nX-From: sfp-web-3\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Encoding: gzip,deflate\r\nHost: www.oneunified.net\r\nUser-Agent: Mozilla/5.0 (Windows N"...
(gdb) p currentString_
$2 = (http::server::buffer_string *) 0x0
(gdb) p currentString_->data
Cannot access memory at address 0x0
(gdb) p currentString_->len
Cannot access memory at address 0x8
(gdb) p &currentString_
$3 = (http::server::buffer_string **) 0x7fffd0004650

in this bit of code in src/http/RequestParser.C:

   2 bool RequestParser::consumeChar(char *d)
   1 {
120    if (currentString_->data == 0)
   1     currentString_->data = &(*d);
   2
   3   if (++currentString_->len > maxSize_)
   4     return false;
   5
   6   return true;
   7 }

which is called from

  42   case header_line_start:
  41     if (input == '\r')
  40     {
  39       httpState_ = expecting_newline_3;
  38       return Indeterminate;
  37     }
  36     else if ((input == ' ' || input == '\t') && haveHeader_)
  35     {
  34       // continuation of previous header
  33       httpState_ = header_lws;
  32       return Indeterminate;
  31     }
  30     else if (!is_char(input) || is_ctl(input) || is_tspecial(input))
  29     {
  28       return False;
  27     }
  26     else
  25     {
  24       req.headers.push_back(Request::Header());
  23       haveHeader_ = true;
  22       consumeToString(req.headers.back().name, MAX_FIELD_NAME_SIZE);
  21       consumeChar(it);
  20       httpState_ = header_name;
  19       return Indeterminate;
  18     }
  17   case header_lws:
  16     if (input == '\r')
  15     {
  14       httpState_ = expecting_newline_2;
  13       return Indeterminate;
  12     }
  11     else if (input == ' ' || input == '\t')
  10     {
   9       return Indeterminate;
   8     }
   7     else if (is_ctl(input))
   6     {
   5       return False;
   4     }
   3     else
   2     {
   1       httpState_ = header_value;
1089       consumeChar(it);
   1       return Indeterminate;
   2     }
   3   case header_name:

and the code at line --36 was probably invoked prior to arrival at 1089 which doesn't initialize with a call to consumeToString of some sort.

Looking at the previous frame:

(gdb) frame 1
#1  0x00007ffff6ce5861 in http::server::RequestParser::consume (this=0x7fffd0004598, req=...,
    it=0x7fffc800b0fc "Accept-Encoding\r\nX-From: sfp-web-3\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Encoding: gzip,deflate\r\nHost: www.oneunified.net\r\nUser-Agent: Mozilla/5.0 (Windows N"...)
    at /home/rpb/data/projects/libs-build/wt/src/http/RequestParser.C:1089
1089    in /home/rpb/data/projects/libs-build/wt/src/http/RequestParser.C
(gdb) p it
$8 = 0x7fffc800b0fc "Accept-Encoding\r\nX-From: sfp-web-3\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Encoding: gzip,deflate\r\nHost: www.oneunified.net\r\nUser-Agent: Mozilla/5.0 (Windows N"...
(gdb) p input
$9 = 65 'A'
(gdb) p httpState_
$10 = http::server::RequestParser::header_value
(gdb) p req.headers
$11 = std::__cxx11::list = {[0] = {name = {data = 0x7fffc800b042 "Expires", len = 7, next = 0x0}, value = {data = 0x7fffc800b04b "Sat Jan 18 22:46:10 UTC 2020", len = 28, next = 0x0}}, [1] = {name = {data = 0x7fffc800b069 "Content-Type", len = 12,
      next = 0x0}, value = {data = 0x7fffc800b077 "text/html", len = 9, next = 0x0}}, [2] = {name = {data = 0x7fffc800b082 "Location", len = 8, next = 0x0}, value = {
      data = 0x7fffc800b08c "http://www.oneunified.net/blog/Trading/SmartQuant/index.blog", len = 60, next = 0x0}}, [3] = {name = {data = 0x7fffc800b0ca "Date", len = 4, next = 0x0}, value = {data = 0x7fffc800b0d0 "Sat, 18 Jan 2020 22:36:10 GMT",
      len = 29, next = 0x0}}, [4] = {name = {data = 0x7fffc800b0ef "Vary", len = 4, next = 0x0}, value = {data = 0x7fffc800b0f5 "Host", len = 4, next = 0x0}}}
(gdb) p haveHeader_
$12 = true

I am trying this code as a work around:

$ git diff src/http/RequestParser.C
diff --git a/src/http/RequestParser.C b/src/http/RequestParser.C
index 654092ec..dcbb8fc2 100644
--- a/src/http/RequestParser.C
+++ b/src/http/RequestParser.C
@@ -1050,6 +1050,10 @@ boost::tribool& RequestParser::consume(Request& req, char *it)
       httpState_ = expecting_newline_3;
       return Indeterminate;
     }
+    else if (( input == '\t') && (nullptr == currentString_ ))
+    {
+      return Indeterminate;
+    }
     else if ((input == ' ' || input == '\t') && haveHeader_)
     {
       // continuation of previous header

or

$ git diff ../src/http/RequestParser.C
diff --git a/src/http/RequestParser.C b/src/http/RequestParser.C
index 654092ec..5dc0973d 100644
--- a/src/http/RequestParser.C
+++ b/src/http/RequestParser.C
@@ -1050,6 +1050,10 @@ boost::tribool& RequestParser::consume(Request& req, char *it)
       httpState_ = expecting_newline_3;
       return Indeterminate;
     }
+    else if (((input == ' ') || (input == '\t')) && (nullptr == currentString_ ))
+    {
+      return Indeterminate;
+    }
     else if ((input == ' ' || input == '\t') && haveHeader_)
     {
       // continuation of previous header

but that haveHeader_ check may cause another hole in the logic somewhere I think.

Good catch. I'm tempted to drop support for line folding rather than fixing this issue.

Page 26 of RFC 7230 says:

   A server that receives an obs-fold in a request message that is not
   within a message/http container MUST either reject the message by
   sending a 400 (Bad Request), preferably with a representation
   explaining that obsolete line folding is unacceptable, or replace
   each received obs-fold with one or more SP octets prior to
   interpreting the field value or forwarding the message downstream.

I mean, that would actually fix this issue. The fact that you're the first person to report this indicates to me that clients generally don't use line folding, and indeed the latest RFC says they "MUST NOT" do that.

Someone was doing something weird, and could maybe have been a misbehavior probe anyway. If dropping support fixes the problem, with an appropriate 400 return, I'm all for it.

I can't fathom what the sender was doing with this request anyway.

Yeah, if folding worked correctly the request still wouldn't be right. The value of the header would become Vary: Host Accept-Encoding, while this should actually be a comma-separated list: Vary: Host, Accept-Encoding.