I ran into this and dug in a bit. It looked like the data was getting truncated, so I turned on CURLOPT_VERBOSE in HTTPSFuture.php. I noticed that the Content-Length header was getting set to the same value (39, for me) every time curl did an outbound request - even though strlen of the JSON body was something around 200.

This sounded like a stale client, so I commented out the curl client pooling code at line 204-211 and instead switched to just calling curl_init() every time with great success - removing the reuse of the client fixed this for me.

It looks like this has been reported to the cURL upstream in slightly different form already:

• Thread starts here, but mis-identifies the root cause of the issue initially.
• It looks like this describes the root cause better, and is consistent with the description above.
• The libcurl maintainer proposes a patch, then merges it.

So this is likely fixed in cURL HEAD.

There doesn't seem to be an easy way for us to version-detect cURL -- phpversion("curl") returns false on my system. We could technically parse it out of phpinfo(), but this is really messy. We could run curl --version and assume whatever we find there is the same as the library version, but that's pretty sketchy too.

Oh, but there's a curl_version() function.

So I guess we can use that to version detect, then maybe disable handle reuse for 7.43, although it looks like the last couple of point releases were pretty quick so maybe we can just exit with a message if 7.43.1 gets cut shortly.

I think that patch fixes this, can someone who has a repro verify that it works for them? You can apply it with arc patch D13417 in libphutil/.

Yep, that resolved it for me, @epriestley.

and

If you are unable to use arc patch due to https://secure.phabricator.com/T9361, you can do the following:

(1) Go to https://secure.phabricator.com/D13417
(2) Click download raw diff, and save it to ~/Desktop/diff.diff
(3) cd /path/to/phabricator/libphutil
(4) patch -p1 < ~/Desktop/diff.diff

No one should need to follow those instructions, because this patch has been in HEAD since late June.