BUG/MAJOR: mux-h1: Don't decrement .curr_len for unsent data

A regression was introduced by commit 140f1a58 ("BUG/MEDIUM: mux-h1: Fix
splicing by properly detecting end of message"). To detect end of the
outgoing message, when the content-length is announced, we count amount of
data already sent. But only data really sent must be counted.

If the output buffer is full, we can fail to send data (fully or
partially). In this case, we must take care to only count sent
data. Otherwise we may think too much data were sent and an internal error
may be erroneously reported.

This patch should fix issues #1510 and #1511. It must be backported as far
as 2.4.

(cherry picked from commit b4eca0e9087762ba7b8c36690001792ac454b7ea)
Signed-off-by: Christopher Faulet <cfaulet@haproxy.com>

diff --git a/src/mux_h1.c b/src/mux_h1.c
index 8b94d1d..a64b700 100644 (file)
--- a/src/mux_h1.c
+++ b/src/mux_h1.c
@@ -2225,7 +2225,6 @@ static size_t h1_process_mux(struct h1c *h1c, struct buffer *buf, size_t count)
                                                                    H1_EV_TX_DATA|H1_EV_STRM_ERR|H1_EV_H1C_ERR|H1_EV_H1S_ERR, h1c->conn, h1s);
                                                        goto error;
                                                }
-                                               h1m->curr_len -= vlen;
                                        }
                                        if ((h1m->flags & H1_MF_RESP) && (h1s->flags & H1S_F_BODYLESS_RESP)) {
                                                TRACE_PROTO("Skip data for bodyless response", H1_EV_TX_DATA|H1_EV_TX_BODY, h1c->conn, h1s, chn_htx);
@@ -2271,6 +2270,8 @@ static size_t h1_process_mux(struct h1c *h1c, struct buffer *buf, size_t count)
                                                    H1_EV_TX_DATA|H1_EV_TX_BODY, h1c->conn, h1s, 0, (size_t[]){v.len});
 
                          skip_data:
+                               if (h1m->state == H1_MSG_DATA && (h1m->flags & H1_MF_CLEN))
+                                       h1m->curr_len -= vlen;
                                if (last_data)
                                        goto done;
                                break;